fix: sanitize public address validation responses

[NateIsern]

Motivation

• Prevent public API leakage of wallet-local metadata returned by the daemon's validateaddress RPC (fields such as ismine, iswatchonly, pubkey, labels, account, etc.).
• Keep the /api/validate-address endpoint safe for unauthenticated callers by exposing only non-sensitive validation information.

Description

• Add sanitizeAddressValidation to server/lib/http.ts which normalizes RPC responses and returns only isvalid and a validated address when present. (new public type PublicAddressValidation).
• Make BlockCache.validateAddress return the sanitized shape instead of the raw RPC result by calling sanitizeAddressValidation in server/lib/cache.ts.
• Harden the public route by parsing/validating the address query via parseAddress before invoking RPC-backed validation in server/index.ts.
• Update the client types and UI to reflect the public, wallet-metadata-free response: adjust NodeAddressValidation in src/hooks/use-validate-address.ts and remove rendering of ismine, iswatchonly, and isscript in src/components/address-validator-content.tsx.
• Add unit tests in server/lib/http.test.ts that assert sensitive fields are stripped and malformed RPC responses normalize to a safe invalid result.

Testing

• Ran unit tests with npm test; all tests passed (4 files passed, 44 tests passed).
• Ran static type checks with npm run typecheck; the TypeScript build passed.
• Added and executed unit coverage for sanitizeAddressValidation in server/lib/http.test.ts, which succeeded as part of the test run.

---

Codex Task