fix: prevent server-controlled alert injection and username path traversal in popup

[Copilot]

Two high-severity findings where server-controlled data was used in the UI without sanitization: raw API error strings rendered via alert() (social engineering vector) and an unvalidated username interpolated directly into a chrome.tabs.create URL (path traversal risk).

Changes

• Alert injection (handleCapture, handleUpload): Replace response.error concatenation in alert() with static generic messages. Server error is still logged to the console for debugging.

// Before
alert('Failed to capture screenshot: ' + response.error);

// After
console.error('Capture failed:', response.error);
alert('Failed to capture screenshot. Please try again.');

• Username URL injection (openDashboard): Validate username against ^[a-zA-Z0-9_.-]+$ before navigation; encode with encodeURIComponent(). Invalid usernames are blocked with a console.warn.

// Before
chrome.tabs.create({ url: `https://dashboard.captureapp.xyz/showcase/${username}` });

// After
if (!/^[a-zA-Z0-9_.-]+$/.test(username)) {
  console.warn('openDashboard: username contains invalid characters, navigation blocked.');
  return;
}
chrome.tabs.create({ url: `https://dashboard.captureapp.xyz/showcase/${encodeURIComponent(username)}` });