security: user-controlled URL params injected directly into Redux store via JSON.parse

## Problem

`ReactiveBase.js` parses URL search parameters directly with `JSON.parse` and injects the result into the Redux store as initial `selectedValues`:

```js
Array.from(params.keys()).forEach((key) => {
try {
const parsedParams = JSON.parse(params.get(key));
selectedValues[key] = { value: parsedParams.value || parsedParams, ... };
} catch (e) { /* silent failure */ }
});
```

A crafted URL can inject arbitrary object structures into the store, potentially triggering unexpected behavior in downstream components that consume `selectedValues`.

## Location

`packages/web/src/components/basic/ReactiveBase.js`, lines 140-162

## Suggested Fix

Validate the shape of parsed values before injection. Expected shapes are string primitives or `{ value, category }` objects. Reject anything that doesn't match.

## Severity

High — URL injection into application state

Start in packages/web/src/components/basic/ReactiveBase.js at lines 140-162 and inspect how URL parameters are parsed before entering selectedValues. Validate that parsed values are string primitives or objects with value and category, rejecting other shapes. Done means valid parameters still populate the Redux state while crafted or malformed structures are ignored.

Written by the indexing model from the issue text.