Add strict input validation and security for MCP tools

[ewalid]

Summary

This PR adds comprehensive input validation and security measures to the MCP server to prevent AI hallucination and prompt injection attacks.

Changes

• Pydantic validation models for all 5 MCP tools:

  • TranslateExcelArgs
  • GetSheetsArgs
  • CountCellsArgs
  • PreviewCellsArgs
  • EstimateCostArgs

• Context field security (most critical):

  • Block common prompt injection patterns (e.g., "ignore previous instructions", "system:", "")
  • Only allow alphanumeric + basic punctuation
  • Maximum 500 character limit

• Language validation:

  • Whitelist of 30 supported languages
  • Rejects unknown languages

• Filename validation:

  • Path traversal prevention (blocks .., /, \)
  • Must have Excel extension
  • Maximum 255 characters

• Base64 validation:

  • Validates encoding
  • Minimum file size (prevent empty files)
  • Maximum 50MB limit

• Sheet names validation:

  • Maximum 50 sheets
  • Maximum 100 char per name

Security Patterns Blocked

- ignore previous/above/all instructions
- disregard previous/above/all instructions
- system:
- <system>
- you are now
- pretend to be
- roleplay as

Test plan

• Test valid translation request
• Test prompt injection in context field (should be blocked)
• Test invalid language (should be rejected)
• Test path traversal in filename (should be blocked)
• Test invalid base64 (should error gracefully)