fix: harden splash screen timer/listener leaks and origin validation

- SplashScreen: track all scheduled timers, clear on unmount (prevents ghost callbacks)
- SplashScreen: manage video pause listener lifecycle (add once, remove when done)
- SplashScreen: clear videoTimeUpdateInterval on unmount
- Chat.vue: validate postMessage origin before accepting ready signal
- App.vue: remove shadowed variable re-declaration in onKeyDown

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

neode-ui/src/views/Chat.vue

@@ -83,6 +83,11 @@ function closeChat() {
 
 function onAiuiMessage(event: MessageEvent) {
   if (!aiuiUrl.value) return
+  // Validate origin — only accept messages from AIUI
+  try {
+    const expected = new URL(aiuiUrl.value, window.location.origin).origin
+    if (event.origin !== expected) return
+  } catch { return }
   const msg = event.data
   if (msg && msg.type === 'ready') {
     aiuiConnected.value = true