fix(security): harden service request boundaries

[ty-everett]

Summary

Wave 2 of the repository health program in #324 hardens three service boundaries that currently produce CodeQL findings:

• bound message quote fan-out to 100 recipients before key validation or database work, and publish the same maximum in the OpenAPI schema (CodeQL chore(sonar): address S2486 swallowed exceptions in sdk (kvstore/identity/http/primitives) #90)
• restrict UHRP object identifiers to bounded canonical Base58, resolve them beneath the served CDN root, and use exclusive file creation to prevent traversal, symlink writes, overwrite races, and TOCTOU behavior (CodeQL chore(sonar): address S2486 swallowed exceptions in helpers #91 and chore(sonar): address S2486 swallowed exceptions in wallet-toolbox (privileged/CWI/knex/chaintracks) #92)
• stop returning caught parser, filesystem, command, or stack details from create-bsv-app's local UI server while retaining server-side diagnostics (CodeQL [codex] Rewrite @bsv/did as SD-JWT VC compatibility layer #112)

The UHRP MIME detector now shares the same runtime CDN root as uploads and the service's express.static('public') mount, avoiding the former source-vs-compiled __dirname mismatch.

CodeQL #120 is intentionally not claimed here. The existing authenticated limiter runs after authentication, so the authentication middleware itself remains unbounded. That finding belongs in the next shared pre-auth and post-auth rate-limiting wave with the related service alerts.

Security end state

• quote work is bounded before any attacker-controlled loop or recipient lookup
• accepted UHRP IDs match the format generated by the service itself and cannot contain separators, encodings, NULs, absolute paths, or traversal segments
• CDN objects are created with wx, so an existing file or symlink cannot be followed or overwritten
• expected configuration failures receive a stable public message; unexpected errors are logged only on the server and receive generic responses
• create-bsv-app now has a standard LCOV-producing coverage script so Sonar and Codecov receive its test evidence on this and future PRs

Verification

• message-box: build, lint, 36/36 tests, and coverage run
• UHRP Lite: build, lint, 20/20 tests, and zero npm audit findings
• create-bsv-app: build, lint, 237/237 tests; 95.52% line / 92.5% statement coverage, including every changed error-handling line
• repository health: 37 projects, 242 ratcheted findings (one fewer), 5 active exceptions, 0 control errors
• cross-package version consistency: clean
• root high/critical audit gate: clean (only 2 low and 4 moderate advisories remain for later dependency waves)
• first hosted analysis on commit 394c9327d: all CI lanes green, no CodeQL PR alerts, Sonar quality gate passed with zero issues/hotspots and A ratings; the follow-up commit adds LCOV ingestion to replace Sonar's initial 0% new-code-coverage result

No package versions are changed or published by this PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!