fix(security): clear open dependency and code scanning alerts

[nedasvi]

Summary

• replace python-jose with PyJWT to remove transitive ecdsa vulnerability exposure
• drop default crawl4ai dependency (keeps existing runtime fallback path) to unblock lxml upgrade
• upgrade lockfile to lxml 6.1.0 and pyjwt 2.12.1
• replace regex-heavy doc sanitizer branch with linear parsing to address ReDoS findings
• adjust API key hash assertion test and add sanitizer unit test

Verification

• uv run pytest -q (219 passed)