Guard layout-review HTTP actions against unknown action names

[thomaswantstobeaskeleton]

Motivation

• Prevent crashes when external layout-review HTTP providers return unexpected action names that don't match the fixed ActionType set, which previously caused downstream grouping code to raise KeyError.

Description

• Validate provider-returned action values before constructing ReviewAction in ui/mainwindow.py by importing ActionType and get_args and adding VALID_REVIEW_ACTIONS = set(get_args(ActionType)).
• Skip any unsupported or non-string action names (with a LOGGER.debug entry) instead of passing them on to downstream logic.
• Coerce and validate block_index as an int and continue to skip negative indices; preserve behavior for valid actions.
• Changes are limited to ui/mainwindow.py around the HTTP provider response parsing and _build_review_result_from_provider_actions logic.

Testing

• Ran python -m compileall -f -q ui/mainwindow.py, which completed (bytecode compiled) for the modified file.
• Attempted a runtime smoke import with python -c "import ui.mainwindow; print('import ok')", which failed due to ImportError: libGL.so.1: cannot open shared object file from OpenCV in this environment; this runtime failure is unrelated to the patch and prevents a full import smoke-test here.

---

Codex Task