feat(exploitation): add Recommendation Memory Poisoning exploit (#25)

[MRX-72]

Summary

Implements #25 (Recommendation Memory Poisoning). Adds a new exploitation
example, exploitation/recommendation_poisoning/, against the existing
llm_memory_local sandbox (#22, #60).

The angle that makes this distinct from the sibling memory_poisoning exploit
is the vector. There, the attacker sends a "remember that ..." chat
message in their own session. Here the attacker never talks to the assistant:
they publish a web widget — a "Share this deal" button — whose visible label is
innocent but which carries a hidden instruction (aria-label + a
display:none span). When the application forwards that page content to the
assistant, the hidden text rides along and is persisted into the unscoped
memory store, steering a later, unrelated user's product recommendation toward
the attacker's brand. This is the indirect prompt-injection scenario described
in the issue and the Microsoft "AI recommendation poisoning" writeup it links.

What's included

• webwidget.py — extracts hidden instructions (aria-label, title,
  hidden / display:none / visibility:hidden text) from attacker markup.
• attack.py — live attack against the running sandbox: harvest the hidden
  instruction, submit it, then confirm the attacker's brand leaks into an
  unrelated victim's recommendation.
• recommendation_demo.py — offline, deterministic companion (no container,
  model, or network). Three phases: neutral baseline → poisoning → leak. It
  drives the sandbox's real app/memory.py (build_memory_context /
  extract_and_store_facts) with a small deterministic recommender stand-in,
  and exits non-zero if the steering is not observed, so it doubles as a
  regression check.
• config/config.toml, Makefile (setup / attack / demo / stop /
  all), and a README with an attack diagram and OWASP mapping.

How to test

Offline, no setup required:

cd exploitation/recommendation_poisoning
python recommendation_demo.py

Expected tail:

STEERING CONFIRMED: the assistant gave a neutral recommendation before
poisoning, then recommended the attacker's brand to an unrelated victim after a
hidden web-widget instruction was laundered through trusted memory.

Live, against the sandbox:

make setup
make attack   # -> [!] VULNERABLE: the poisoned brand 'QuantumGlow' leaked ...

Notes

• Reuses sandboxes/llm_memory_local unchanged; no sandbox edits.
• Payloads are harmless, clearly-marked test values: a fictional brand
  (QuantumGlow) and a non-resolving .test store.
• Formatted with black and isort (--profile black); mypy clean.