fix(captain): add operation whitelist to prevent method injection

- Add ALLOWED_OPERATIONS whitelist to validate operation parameter
- Prevent arbitrary method invocation via send()
- Refactor tone methods using metaprogramming to reduce duplication
- Add specs for invalid operations and injection attempts

spec/lib/captain/rewrite_service_spec.rb

@@ -139,4 +139,28 @@ RSpec.describe Captain::RewriteService do
       expect(result[:message]).to eq('Rewritten text')
     end
   end
+
+  describe '#perform with invalid operation' do
+    it 'raises ArgumentError for unknown operation' do
+      invalid_service = described_class.new(
+        account: account,
+        content: content,
+        operation: 'invalid_operation',
+        conversation_display_id: conversation.display_id
+      )
+
+      expect { invalid_service.perform }.to raise_error(ArgumentError, /Invalid operation/)
+    end
+
+    it 'prevents method injection attacks' do
+      dangerous_service = described_class.new(
+        account: account,
+        content: content,
+        operation: 'perform',
+        conversation_display_id: conversation.display_id
+      )
+
+      expect { dangerous_service.perform }.to raise_error(ArgumentError, /Invalid operation/)
+    end
+  end
 end