fix: security hardening and code quality improvements

[HugoMSFT]

Summary

Comprehensive security hardening and code quality improvements across the Python backend.

Security Fixes

• Path traversal in CSV download endpoint — validate filename chars and realpath containment
• Code injection — validate table_name and write_mode before embedding in PySpark code
• ast.literal_eval on untrusted data — replaced with json.loads for CSV keyword parsing
• JWT handling — validate 3-part token structure before decoding payload
• Secret key warning — log a warning when FLASK_SECRET_KEY is not set
• Input validation — keyword count/length limits and Flask MAX_CONTENT_LENGTH (16 MB)

Reliability Fixes

• DB connection leaks — added finally: conn.close() to 8 methods across fabric_sql_writer and state_manager
• Session resource leaks — added close() to all 6 collector classes and call it after collect()
• Thread safety — threading.Lock around global mutable state (collection_status, last_collected_feedback)

Code Quality

• Replaced stderr debug prints with proper logger calls in fabric_writer
• Removed unused xml.etree.ElementTree import
• Moved inline import json to module top-level in fabric_sql_writer
• Added exc_info=True to exception handlers missing stack traces
• Removed overly-aggressive regex that stripped legitimate text in utils.py

Files Changed

• src/app.py — thread lock, path traversal fix, input validation, collector close calls
• src/collectors.py — close() methods, unused import removal, error logging
• src/fabric_writer.py — input validation, debug print cleanup
• src/fabric_sql_writer.py — connection leak fixes, import cleanup
• src/state_manager.py — JWT validation, connection leak fixes
• src/utils.py — regex fix