feat(mcp): add input sanitization and test coverage

[CoderMungan]

MCP-SAN (#49): Input sanitization for the MCP server layer.

• Add sanitize package: Content (Markdown structure injection), Reflect (truncate + strip control chars for error messages), SessionID (path-safe session identifiers), StripControl, Truncate
• Sanitize all reflected user inputs in dispatch error messages (tool names, prompt names, resource URIs) via sanitize.Reflect
• Reject unknown entry types before writing to .context/ files
• Enforce MaxContentLen (32KB) on entry content in extract.EntryArgs
• Sanitize entry content and optional fields via sanitize.Content and extract.SanitizedOpts before writing
• Cap journal source limit to MaxSourceLimit (100)
• Sanitize caller identifiers in session events
• Add input length constants to config/mcp/cfg
• Add error message keys for input-too-long and unknown-entry-type

MCP-COV (#50): Comprehensive test coverage for MCP subsystem.

• internal/mcp/proto: 22 schema round-trip and edge-case tests
• internal/mcp/session: 7 state lifecycle tests (100% coverage)
• internal/mcp/server: 4 integration tests (Serve edge cases, prompt add-learning)
• internal/mcp/server/def/tool: 9 tool definition tests
• internal/mcp/server/def/prompt: 9 prompt definition tests
• internal/mcp/server/extract: 7 extraction and sanitization tests
• internal/mcp/server/io: 3 WriteJSON tests (100% coverage)
• internal/mcp/server/out: 8 response builder tests (100% coverage)
• internal/mcp/server/parse: 3 request parsing tests (100% coverage)
• internal/mcp/server/stat: 2 statistics tests (100% coverage)
• internal/sanitize: 22 sanitization tests (Content, Reflect, SessionID, StripControl, Truncate + existing Filename)
• Server package coverage: 73% -> 92%

Closes #49
Closes #50