Add input validation to message handler

[malston]

Summary

The message handler in background.js doesn't validate incoming message properties.

Current Behavior

request.action, request.mode, and request.folderId are used without validation.

Expected Behavior

Validate message properties before processing:

• Check action is a known value
• Validate mode when present
• Validate folderId format when present

Priority

Low

Related

Split from #3 (item #10)