Fix SQL injection and refresh scheduling in convoy panel

- Add convoyID validation with regex pattern ^hq-[a-zA-Z0-9-]+$
  to prevent SQL injection in getTrackedIssueStatus (gt-ur4c4)
- Fix duplicate refresh scheduling: tick schedules fetch, fetch
  schedules next tick (gt-yqfrx)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/tui/feed/model.go

@@ -190,11 +190,14 @@ func (m *Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 
 	case convoyUpdateMsg:
 		if msg.state != nil {
+			// Fresh data arrived - update state and schedule next tick
 			m.convoyState = msg.state
 			m.updateViewContent()
+			cmds = append(cmds, m.convoyRefreshTick())
+		} else {
+			// Tick fired - fetch new data
+			cmds = append(cmds, m.fetchConvoys())
 		}
-		// Schedule next refresh
-		cmds = append(cmds, m.fetchConvoys(), m.convoyRefreshTick())
 
 	case tickMsg:
 		cmds = append(cmds, tick())