fix(security): validate intent action before consuming notification session id (issue #832) (#845)

MainActivity is exported (launcher requirement) and consumed the
session-id extra from any incoming intent without checking the action —
a foreign app could launch it explicitly and force-navigate to a chat
screen. Guard consumeNotificationIntent() on the app's own notification
action and hoist the action string into a shared const so
ChatNotificationService and MainActivity can never drift.

Co-authored-by: M57 <hy4ri@users.noreply.github.com>

app/src/main/java/com/m57/hermescontrol/notification/ChatNotificationService.kt

@@ -185,7 +185,7 @@ class ChatNotificationService : Service() {
     private fun buildContentIntent(sessionId: String?): PendingIntent {
         val intent =
             Intent(this, MainActivity::class.java).apply {
-                action = "$packageName.ACTION_OPEN_CHAT_FROM_NOTIFICATION"
+                action = MainActivity.ACTION_OPEN_CHAT_FROM_NOTIFICATION
                 flags = Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP
             }
         if (!sessionId.isNullOrBlank()) {