Fix/64 prompt injection newline sanitization

[sansin112]

Summary

This PR resolves a prompt injection vulnerability where newline-triggered control vectors were not properly neutralized during resume ingestion (#64). Previously, PromptDefense.sanitize() only stripped angle brackets and template delimiters, allowing multi-line role-switching tags (such as \nSystem:) and fake section separators (such as \n---) to pass through unescaped into the LLM context. This change updates PromptDefense.sanitize() to actively neutralize role switches and section delimiters, updates INJECTION_PATTERNS regex matching, and ensures raw resume text is properly sanitized prior to chunking and embedding.

Issue

Closes #64

Changes

• Extended PromptDefense.sanitize() in safety/prompt_defense.py to strip and replace multi-line role-switching vectors (\nSystem:, \nHuman:, \nAssistant:) with [sanitized-role]: and section separators (---, ===) with [sanitized-delimiter].
• Restored and refined regex pattern matching in INJECTION_PATTERNS to cover flexible whitespace and newline injection boundaries without breaking legitimate job titles (e.g., "System Administrator").
• Updated tests/unit/test_prompt_defense.py with comprehensive test coverage for multi-line sanitization, regression checks for legitimate resume text, and explicit mypy return type annotations (-> None).

Testing

• Unit tests pass (make test-unit)
• Integration tests pass (make test-integration)
• Linter passes (make lint)
• Type checker passes (make typecheck)
• New/updated tests cover the changes

Screenshots / Demo

N/A (Backend defense and sanitization logic update)

Notes for Reviewers

• Please verify that the regex boundary in PromptDefense.sanitize() effectively neutralizes \nSystem: role switches without causing false positives on common resume phrases or bullet points.
• All 30 unit tests in tests/unit/test_prompt_defense.py are passing, and static analysis checks (ruff, black, mypy) have completed with zero errors.