docs(cortex-cli): comprehensive deep code review and analysis

[echobt]

Summary

This PR adds a detailed code review document for the cortex-cli crate based on a comprehensive analysis of all source files.

What's Included

The DEEP_CODE_REVIEW.md document provides:

🔴 Critical Issues

• Security concerns around URL validation in MCP commands
• Incomplete sandbox implementation on non-Linux platforms
• API key exposure risks in login flows

🟠 Code Quality Issues

• Code Duplication: Repeated get_fabric_home() implementations across 4+ files
• Naming Inconsistency: Mixed use of 'Fabric' vs 'Cortex' throughout the codebase
• Large Functions: Some functions (like HTML processing) exceed 200 lines

🟡 Potential Bugs

• Race conditions in session listing
• UTF-8 string slicing issues
• Incomplete feature flag handling

📊 Performance Concerns

• Synchronous file I/O in async contexts
• Inefficient stats collection reading all session files
• Multiple string allocations in HTML processing

🔧 Missing Functionality Tracking

• MCP server mode (not implemented)
• PR review automation (stub only)
• Server attachment (falling back to local)

📋 Testing Gaps

• Missing integration tests for export/import
• Incomplete error path coverage
• No async timeout scenario tests

Files Analyzed (16 modules, ~400KB total)

File	Size	Key Issues
mcp_cmd.rs	60KB	URL validation bypass risk
debug_cmd.rs	48KB	Sync I/O in async, should be split
agent_cmd.rs	47KB	Duplicate utility functions
main.rs	41KB	Silent update check failures
scrape_cmd.rs	40KB	Very large processing function
run_cmd.rs	39KB	Server attachment not implemented
uninstall_cmd.rs	30KB	Naming inconsistencies
github_cmd.rs	23KB	Multiple 'not yet implemented' stubs
stats_cmd.rs	20KB	Hardcoded pricing data
Other modules	~50KB	Various minor issues

Recommendations (Prioritized)

High Priority

1. Improve URL validation to prevent bypass attacks
2. Complete sandbox implementation or add warnings
3. Standardize 'Cortex' vs 'Fabric' naming
4. Create shared utility functions for common patterns

Medium Priority

5. Use async file I/O in async contexts
6. Split large functions into smaller units
7. Add integration tests for critical paths

Low Priority

8. Replace magic numbers with named constants
9. Improve error messages with more context
10. Add debug-level logging for troubleshooting

---

This review is intended to guide future development and does not block any current functionality.