Harden stats APIs and fix Electron Yomitan debug runtime

- Validate stats session IDs/limits and add AnkiConnect request timeouts
- Stabilize stats window/runtime lifecycle and tighten window security defaults
- Fix Electron CLI debug startup by unsetting `ELECTRON_RUN_AS_NODE` and wiring Yomitan session state
- Expand regression coverage for tracker queries/events ordering and session aggregates
- Update docs for stats dashboard usage and Yomitan lookup troubleshooting

scripts/test-yomitan-parser.ts

@@ -379,6 +379,15 @@ function resolveYomitanExtensionPath(explicitPath?: string): string | null {
   });
 }
 
+async function loadElectronModule(): Promise<typeof import('electron') | null> {
+  try {
+    const electronImport = await import('electron');
+    return (electronImport.default ?? electronImport) as typeof import('electron');
+  } catch {
+    return null;
+  }
+}
+
 async function setupYomitanRuntime(options: CliOptions): Promise<YomitanRuntimeState> {
   const state: YomitanRuntimeState = {
     available: false,
@@ -394,16 +403,13 @@ async function setupYomitanRuntime(options: CliOptions): Promise<YomitanRuntimeS
     return state;
   }
 
-  const electronModule = await import('electron').catch((error) => {
-    state.note = error instanceof Error ? error.message : 'electron import failed';
-    return null;
-  });
+  const electronModule = await loadElectronModule();
   if (!electronModule?.app || !electronModule?.session) {
     state.note = 'electron runtime not available in this process';
     return state;
   }
 
-  if (options.yomitanUserDataPath) {
+  if (options.yomitanUserDataPath && typeof electronModule.app.setPath === 'function') {
     electronModule.app.setPath('userData', options.yomitanUserDataPath);
   }
   await electronModule.app.whenReady();