fix: shell.openExternal 添加协议白名单校验

仅允许 http/https 协议，阻止 javascript: 等潜在恶意链接。

renderer/renderer.js

@@ -142,6 +142,14 @@
         if (target) target.scrollIntoView({ behavior: 'smooth' });
         return;
       }
+      // Only allow http/https protocols
+      try {
+        const url = new URL(href);
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') return;
+      } catch {
+        // Relative URLs fail new URL(), but we already handled anchors above
+        return;
+      }
       // External links: open in system browser
       if (typeof window.electronAPI !== 'undefined' && window.electronAPI.openExternal) {
         window.electronAPI.openExternal(href);