fix: nightly hardening - MCP validate path boundary

[mouse-value-add]

Problem

The MCP server enforced path safety for youmd_init, but youmd_validate could read arbitrary local paths. In MCP-hosted contexts, that expands file disclosure risk and weakens boundary guarantees. Also, malformed path inputs (e.g., null-byte/control-char paths) were not explicitly rejected.

Approach

• Reused the existing path-safety boundary for youmd_validate so it now rejects paths outside home/current project.
• Hardened isPathSafe to fail closed on malformed path input and reject null-byte/control-character paths.
• Centralized refusal messaging via a shared helper to keep behavior consistent across MCP tools.
• Added test coverage for malformed path rejection.

Verification

• npm test -- --run test/mcp/server.test.ts
• npm run build

Risks

• Some users may currently validate files outside home/project roots; those calls now return a refusal message.
• Path restrictions could feel stricter in unusual automation environments.

Rollback Plan

• Revert this PR commit to restore prior youmd_validate path behavior.
• If needed, reintroduce scoped allowlisting in a follow-up instead of full rollback.