fix(app): validate content pack URL scheme and schema in importFromUrl

Require https: protocol for remote content pack imports, rejecting
http:, file:, javascript:, and other schemes. Add schema validation
to verify required fields (id, name, items) and item shape (type,
title) before accepting imported packs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/src/composables/useContentPacks.ts

@@ -108,14 +108,24 @@ export function useContentPacks() {
 
   async function importFromUrl(url: string): Promise<ContentPack | null> {
     try {
+      const parsed = new URL(url)
+      if (parsed.protocol !== 'https:') return null
+
       const response = await fetch(url)
       if (!response.ok) return null
       const data = (await response.json()) as ContentPack
-      if (!data.id || !data.name || !data.items) return null
+      if (
+        !data.id || typeof data.id !== 'string' ||
+        !data.name || typeof data.name !== 'string' ||
+        !Array.isArray(data.items) ||
+        !data.items.every((item: unknown) => {
+          const i = item as Record<string, unknown>
+          return i && typeof i.type === 'string' && typeof i.title === 'string'
+        })
+      ) return null
 
       const existing = installedPacks.value.find((p) => p.id === data.id)
       if (existing) {
-        // Update existing
         Object.assign(existing, data, { installedAt: Date.now(), source: url })
       } else {
         installedPacks.value.push({ ...data, installedAt: Date.now(), source: url })