fix(security): harden sidecar auth, bump deps, validate contactMessages (#3388)

* fix(security): harden sidecar auth, bump deps, validate contactMessages

Addresses items from internal security review:

- C2 protobufjs RCE (GHSA-xq3m-2v4x-88gg, CVSS 9.8) — add a top-level
  npm override forcing protobufjs ^7.5.5, eliminating the vulnerable
  6.11.4 pinned transitively by onnx-proto via @xenova/transformers.

- H1 sidecar fail-open auth (src-tauri/sidecar/local-api-server.mjs) —
  previously, an unset LOCAL_API_TOKEN silently disabled the auth
  gate, turning any standalone sidecar (Docker mode, manual launch)
  into an open local-HTTP proxy. Now default-deny: missing token
  returns 503 with a clear log line. The Tauri Rust shell already
  sets the token at launch, so production behaviour is unchanged.

- H2 dompurify advisories (GHSA-39q2-94rc-95cp, GHSA-h7mw-gpvr-xq4m) —
  bump dompurify ^3.1.7 → ^3.4.0 (lockfile resolves to 3.4.x). The
  widget-sanitizer iframe sandbox remained a defence-in-depth layer.

- M2 contactMessages.submit DoS surface — the Convex public mutation
  had no length bounds, no email validation, and no throttle. Add
  RFC-aligned max lengths, email shape check, control-char strip,
  and a per-normalized-email rate limit (5 / 1h via a new index).
  Edge-side validation in submit-contact.ts is unchanged; this is
  defence-in-depth against direct Convex client calls.

Tests:
- New convex/__tests__/contactMessages.test.ts (7 cases) covers
  validation, clipping, control-char stripping, and rate-limit
  bucketing (incl. case-insensitive normalization).
- New default-deny regression test in local-api-server.test.mjs.
- Updated existing sidecar tests to use a shared authFetch helper
  now that the global gate is active.

Verification: npm run typecheck, typecheck:api, test:convex (90/90),
test:sidecar (only pre-existing 'strips browser origin headers' flake
remains, unrelated to these changes), npm audit confirms protobufjs
critical and dompurify moderate advisories are resolved.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(docker): inject sidecar local api token

* fix(contact): preserve newlines and tabs in message field

The previous clip() stripped every C0 control (\x00-\x1F), which
collapsed multi-line enterprise-contact messages into a single line.
Split into two policies:

- STRICT_CONTROL_RE (default): unchanged behavior for short fields
  (name/email/org/phone/source) where CR/LF could enable log forging
  or header injection in downstream single-line interpolation.
- MULTILINE_CONTROL_RE: preserves TAB and LF, used for `message` so
  operators see the prose formatted the way the user typed it. CR
  stays stripped so Windows-style line endings collapse cleanly to LF.

Adds a regression test using String.fromCharCode for the four control
codes so the next "regex simplification" can't silently re-collapse
message bodies.

* fix(leads): translate Convex rate_limited error to HTTP 429

The Convex contactMessages.submit throttle was raising a ConvexError
with `data.kind === 'rate_limited'`, but the edge handler didn't
catch it, so an over-quota submission bubbled to the browser as an
opaque HTTP 500. Wrap the mutation call, detect the rate_limited
payload, and surface it as ApiError(429) — matching the convention
already established in register-interest.ts. Any other error from
Convex rethrows unchanged.

* fix(lockfile): restore 5 nested utf-8-validate entries dropped by npm 11

CI's bundled npm 10.x exits 1 on `npm ci` with "Missing: utf-8-validate@5.0.10
from lock file" for five nested paths under @react-native/dev-middleware,
jayson, metro, react-devtools-core, and react-native. The entries were
silently removed when the earlier dompurify bump was committed under npm
11.x, which is lenient about peer-optional resolution; npm 10.x is not.

Regenerated via `npx -p npm@10.9.2 npm install`. Touches the lockfile only
(75 insertions). Fixes the gate / Lint Code / Test / Typecheck failures on
PR #3388 that all bottom out at the same `npm ci` rejection.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Elie Habib <elie.habib@gmail.com>