fix(SEC-WEB-30+31+36): Validate JSON.parse/localStorage deserialization

Add runtime type validation after all JSON.parse calls in the web app to
prevent runtime crashes from corrupted or tampered storage data. Creates a
shared safeJsonParse utility with type guard functions for each data shape
(Message[], ChatOverlayState, LayoutConfigRecord). All four affected
callsites now validate parsed data and fall back to safe defaults on
mismatch.

Files changed:
- apps/web/src/lib/utils/safe-json.ts (new utility)
- apps/web/src/lib/utils/safe-json.test.ts (25 tests)
- apps/web/src/hooks/useChat.ts (deserializeMessages)
- apps/web/src/hooks/useChat.test.ts (3 new corruption tests)
- apps/web/src/hooks/useChatOverlay.ts (loadState)
- apps/web/src/hooks/useChatOverlay.test.ts (3 new corruption tests)
- apps/web/src/components/chat/ConversationSidebar.tsx (ideaToConversation)
- apps/web/src/lib/hooks/useLayout.ts (layout loading)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/web/src/hooks/useChatOverlay.ts

@@ -4,6 +4,7 @@
  */
 
 import { useState, useEffect, useCallback } from "react";
+import { safeJsonParse, isChatOverlayState } from "@/lib/utils/safe-json";
 
 interface ChatOverlayState {
   isOpen: boolean;
@@ -27,7 +28,7 @@ const DEFAULT_STATE: ChatOverlayState = {
 };
 
 /**
- * Load state from localStorage
+ * Load state from localStorage with runtime type validation
  */
 function loadState(): ChatOverlayState {
   if (typeof window === "undefined") {
@@ -37,7 +38,7 @@ function loadState(): ChatOverlayState {
   try {
     const stored = window.localStorage.getItem(STORAGE_KEY);
     if (stored) {
-      return JSON.parse(stored) as ChatOverlayState;
+      return safeJsonParse(stored, isChatOverlayState, DEFAULT_STATE);
     }
   } catch (error) {
     console.warn("Failed to load chat overlay state from localStorage:", error);