fix(security): validate job IDs before filesystem use

[McanKul]

Summary

• reject malformed job IDs before they reach temporary work paths
• apply the check consistently to PDF and render jobs
• cover traversal, separators, empty values, and length limits

Validation

• cargo test --manifest-path src-tauri/Cargo.toml --lib commands::jobs::tests::job_ids_cannot_leave_the_work_folder
• cargo check --manifest-path src-tauri/Cargo.toml

Small reviewed groundwork for the M4 text-editing work. Targets development only.