Claude Code RCE: Exploiting Deeplink Handlers via Settings Injection