fix: add title validation — sanitize, length limit, control char stripping
- Add SessionDB.sanitize_title() static method:
- Strips ASCII control chars (null, bell, ESC, etc.) except whitespace
- Strips problematic Unicode controls (zero-width, RTL override, BOM)
- Collapses whitespace runs, strips edges
- Normalizes empty/whitespace-only to None
- Enforces 100 char max length (raises ValueError)
- set_session_title() now calls sanitize_title() internally,
so all call sites (CLI, gateway, auto-lineage) are protected
- CLI /title handler sanitizes early to show correct feedback
- Gateway /title handler sanitizes early to show correct feedback
- 24 new tests: sanitize_title (17 cases covering control chars,
zero-width, RTL, BOM, emoji, CJK, length, integration),
gateway validation (too long, control chars, only-control-chars)
34b4fe495e