prompt injection defense for MCP tool responses

feat(security): prompt injection defense for MCP tool responses (#20)

## Summary

- Sanitize API response bodies before returning to LLM: strip Unicode
attack vectors (bidi overrides, zero-width chars, Tags block, variation
selectors, soft hyphen), collapse whitespace-padding runs (50+ spaces →
`[WHITESPACE REMOVED]`)
- Detect injection patterns (16 regex patterns) in sanitized responses —
observability only, content never suppressed
- Throttled detection logger: 1 event/hostname/60s, never logs matched
content
- Optional spotlighting: wrap responses in per-request UUID sentinel
tags (`config.enableSpotlighting`)
- Sanitize all user-controlled tool metadata (schema endpoint
titles/descriptions/param descriptions, custom tool descriptions, auth
tokens in prompt templates)

## Handoff Document

See `docs/work/handoff-feat-prompt-injection-defense.md` for full
context, design decisions, and review guidance.

## Testing

- 66 new unit tests (58 for `sanitize.ts`, 8 for `detection-logger.ts`)
- All 396 tests pass (`npm test`)
- TypeScript compiles cleanly (`npm run build`)

## Post-Deploy Monitoring & Validation

- Monitor logs for `[injection-defense] [...] InjectionDetected` entries
— these indicate suspicious API response content
- Throttle (1/hostname/min) prevents log flooding; if a host fires
repeatedly after each minute elapses, investigate the API
- No functional behavior change for clean responses — sanitization is a
no-op on normal UTF-8 text

---
[![Compound
Engineered](https://img.shields.io/badge/sixees-Compound_Engineered-blue)](https://github.com/sixees/sixees-marketplace)