fix: nightly hardening - MCP validate path boundary guard

[mouse-value-add]

Problem

The MCP youmd_validate tool accepted arbitrary file paths. This allowed validation reads outside the intended home/project boundaries, while youmd_init already enforced path safety.

Approach

• Reused the existing isPathSafe guard in youmd_validate.
• Added a shared unsafe-path message helper to keep behavior consistent between youmd_init and youmd_validate.

Verification

• Ran targeted tests: npx vitest run test/mcp/server.test.ts --reporter=dot (7 passed).
• Confirmed no behavior change for safe paths.

Risks

• Low risk: only blocks unsafe validate paths that were previously allowed.
• Users validating files outside home/cwd will now receive a refusal message.

Rollback plan

• Revert this commit to restore prior youmd_validate behavior.