Closes #276

Summary

Fixes un-guarded new URL(url) call in openInBrowser (src/lib/browser.ts) so malformed URLs return a clean CLI VALIDATION_ERROR (exit code 5) instead of crashing with an unhandled Node.js TypeError.

Problem

When openInBrowser(url) receives a malformed or unparseable URL string (e.g. "not a url"), new URL(url) throws a raw Node.js TypeError: Invalid URL.
Because this call was not wrapped in a try/catch block:

• The process crashed with an unhandled exception (exit code 1) and printed a raw V8 stack trace.
• Non-HTTP schemes like file:// already threw VALIDATION_ERROR (exit 5), creating an inconsistent error contract for bad inputs.

Solution

Wrap new URL(url) in a try/catch block in openInBrowser:

try {
  parsed = new URL(url);
} catch {
  throw localValidationError('url', 'must be a valid http(s) URL', undefined, 'field');
}

Test Coverage

Updated src/lib/browser.test.ts to assert that malformed URL inputs throw ApiError with exitCode = 5. All unit tests pass.