fix(security): security audit and hardening (#207)

* fix(security): harden SVG sanitizer, rate limiting, and analytics defaults

- SVG: add control-char stripping in href values to block whitespace/null-byte
  obfuscated javascript: URIs; block <feImage> with external href (SSRF via
  SVG filter primitives); expand test suite to 32 inline bypass payloads
- Rate limiting: add per-route limits on tool endpoints (60/min) and batch
  (20/min); fix compose files defaulting RATE_LIMIT_PER_MIN to 0 which mapped
  to 50,000 in code; simplify rate limit registration to use env.ts default
- Analytics: default ANALYTICS_ENABLED to false so self-hosters do not
  unknowingly send telemetry
- Docker: add --max-time 5 and -s flags to compose healthcheck curl commands

* fix: remove stale login limit bypass, reduce error log noise, clean up fixtures

- Fix getLoginAttemptLimit() ignoring LOGIN_ATTEMPT_LIMIT when global rate
  limit exceeded 1000/min, which let the global limit override the stricter
  per-route login brute-force protection
- Downgrade rate limit 429 responses from error to warn level in the global
  error handler to avoid log noise and unnecessary Sentry reports
- Log 4xx client errors at warn level instead of error level
- Remove 11 orphaned SVG attack fixture files replaced by inline test payloads

tests/unit/api/tool-factory-route.test.ts

@@ -153,7 +153,9 @@ function makeMockConfig(
 function createMockApp() {
   const routes: Record<string, (req: unknown, reply: unknown) => Promise<unknown>> = {};
   return {
-    post: vi.fn((path: string, handler: (req: unknown, reply: unknown) => Promise<unknown>) => {
+    post: vi.fn((...args: unknown[]) => {
+      const path = args[0] as string;
+      const handler = args[args.length - 1] as (req: unknown, reply: unknown) => Promise<unknown>;
       routes[path] = handler;
     }),
     routes,
@@ -235,7 +237,11 @@ describe("createToolRoute", () => {
       const app = createMockApp();
       const id = uniqueId();
       createToolRoute(app as never, makeMockConfig(id));
-      expect(app.post).toHaveBeenCalledWith(`/api/v1/tools/${id}`, expect.any(Function));
+      expect(app.post).toHaveBeenCalledWith(
+        `/api/v1/tools/${id}`,
+        expect.any(Object),
+        expect.any(Function),
+      );
     });
 
     it("adds the tool config to the registry", () => {