fix(cli): strip terminal control characters from API content

[enesgules]

Summary

ctx7 docs and ctx7 library printed API-returned content (library titles, descriptions, doc snippets) straight to stdout. Because the index is crowdsourced, a malicious library entry could embed raw ANSI/OSC escape sequences (screen clear, cursor moves, OSC 52 clipboard writes) that execute in the user's terminal.

This adds a single stripControlChars helper in api.ts and applies it at the trust boundary on the crowdsourced responses: resolveLibrary, searchLibraries, and both the text and JSON branches of getLibraryContext. It removes C0 controls (except tab and newline), DEL, and C1. Our own picocolors styling is unaffected since it is applied after sanitization.

Verification

• Typecheck, lint, build, and full test suite pass (362 tests)
• New unit test covers OSC, CSI, CR, C1, and nested objects
• Ran the built CLI against a mock API serving OSC 52 and CSI clear sequences in library title/description, text docs, structured docs, and --json: zero ESC bytes reach stdout

Credit

Reported by Syed Anas Mohiuddin, independent security researcher.

https://claude.ai/code/session_01XXTv4m4tzcTPQYfa9DvGsv