fix: validate render IPC payload before spawning renderer

[ubugeeei]

Finding

render:start accepts renderer-provided payload values and directly serializes them into the render process argument string. Width, height, fps, frame count, workers, preset, and ffmpeg threads are not runtime validated in the Electron main process.

Evidence

• electron/render-settings-preload.ts exposes startRender through contextBridge.
• electron/main.ts startRenderProcess builds argsString directly from RenderStartPayload.

Acceptance criteria

• Add main-process validation for render:start payloads.
• Reject non-finite, unsafe, or out-of-range values before spawning.
• Keep the preset/encode allowlist explicit.
• npm run build:electron passes.

[ubugeeei]

対応済みです。修正は PR #1 / commit 9cf4498 に反映済みです。