Harden formula sync and AI proxy

[Ge-Shun]

Summary

• Anchor Word formulas with tagged content controls and serialize auto-sync updates to prevent stale selection writes.
• Surface lossy conversion warnings and block unsafe automatic replacements.
• Harden the local AI proxy, API-key lifecycle, request limits, host validation, and client-side cancellation.
• Add MathLive integration, proxy security, release metadata tests, CI, and third-party notices.

Validation

• npm run check
• npm test — 52 tests passed
• npm audit — 0 vulnerabilities
• npm run validate — Office manifest valid