fix: validate plugin names in tailwind config generator to prevent RCE

[TemaDeveloper]

Summary

Fixes the Code Injection → RCE vulnerability (CVSS 9.3, Critical) in tailwind_config_gen.py reported in #246.

The _format_plugins() method interpolated plugin names directly into JavaScript require('...') statements without any sanitization. A plugin name containing a single quote (e.g. fs').writeFileSync(...)) could break out of the require() call and inject arbitrary JavaScript that executes when Node.js loads the generated tailwind.config.js.

Fix

• Add a strict regex allowlist (^(@[a-zA-Z0-9_-]+/)?[a-zA-Z0-9_-]+(/[a-zA-Z0-9_.-]+)*$) that matches valid npm package name patterns
• Reject any plugin name that doesn't match before generating output, raising a ValueError with a descriptive message
• This blocks all injection vectors: single quotes, parentheses, semicolons, backticks, etc.

Testing

Input	Result
@tailwindcss/typography	Accepted
tailwindcss-animate	Accepted
some-plugin/sub-path	Accepted
fs').writeFileSync('/tmp/rce','PWNED'),require('fs	Rejected with ValueError
legit'); process.exit(1); //	Rejected with ValueError

Normal config generation with valid plugins produces identical output — no regressions.

Closes #246