fix: prevent GalleryDetail crash on browser-open failure

[cursor]

Summary

• fixed a critical crash path introduced by the gallery "open in browser" keybind
• added a safe browser-open helper that catches open() failures and returns a user-facing error
• updated GalleryDetail to use the safe helper so keypress handling cannot trigger an unhandled rejection
• added unit tests for URL encoding and failure handling

Critical bug

Pressing o in gallery detail called open(...) without awaiting or handling rejections. If the OS/browser launch failed (e.g. missing/blocked browser command, headless env), the promise rejection was unhandled and could terminate the Node process, crashing the TUI.

Validation

• pnpm build
• pnpm test
• pnpm typecheck
• pnpm lint