fix: improve ask AI rewrite resilience

[variablenix]

Summary

• retry provider meta-text once with a stricter answer-only prompt within the original timeout
• classify explicit insufficient-source responses accurately and preserve the source fallback
• treat question/source content as untrusted prompt data
• align examples and documentation on an instruction-tuned free OpenRouter model

Verification

• go test ./...
• go test -race ./...
• go vet ./...
• go mod verify
• git diff --check