#4618: security(tts): validate JSON structure when reading TTS user prefs

## Summary - Add runtime validation to `readPrefs()` in `src/tts/tts.ts` before trusting parsed JSON as `TtsUserPrefs` - Previously `JSON.parse()` result was cast directly with `as TtsUserPrefs` without verifying the shape - New `safeParseTtsPrefs()` validates the parsed value is a plain object and the `tts` field (if present) is also an object - Malformed or tampered files now safely fall back to `{}` instead of propagating unexpected data ## Changed files | File | Change | |------|--------| | `src/tts/tts.ts` | Add `safeParseTtsPrefs()` with runtime shape check; use it in `readPrefs()` | ## Test plan - [x] `pnpm vitest run src/tts` -- 33/33 tests pass - [x] `pnpm lint` -- 0 warnings, 0 errors - [x] `pnpm format` -- all files formatted correctly lobster-biscuit