feat: per-sender rate limiting to cap API cost - #5

tests/live.test.js exercises the full analyze() pipeline through the real
OpenRouter model — 3 distinct cases = 3 real calls (not repeats):
  1. obvious e-challan scam  → must flag fraud + strip the fake link (#5)
  2. benign message          → returns a valid Urdu verdict, no crash
  3. embedded prompt injection → must NOT be cleared as safe (#2)

Skips cleanly (exit 0) when OPENROUTER_API_KEY is absent, so it never
blocks a merge or a key-less environment. Run via `npm run test:live`.

Verified live: all assertions pass against the production model; the
injection case confirms the model is not hijacked into clearing a scam.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Implements the code-level guardrails for operating an LLM in an
adversarial civic context. Policy/roadmap items are documented in
docs/GUARDRAILS.md.

- codewithfourtix#2 Prompt injection: analyzed content is wrapped in <message_to_analyze>
  tags, delimiter breakout is escaped, and the system prompt treats any
  embedded "mark me safe" instruction as a fraud signal.
- codewithfourtix#3 PII: redact CNIC / phone / account numbers before logging, hash
  sender ids in logs, redact the high-risk webhook body (src/redact.js).
- codewithfourtix#4 Calibrated/aid: never clear a BISP/Ehsaas message without the 8171
  verification line; low confidence defaults to "verify, don't act".
- codewithfourtix#5 Hallucination: strip links (non *.gov.pk/.gop.pk) and phone/UAN
  numbers not on the official allowlist from every reply (src/sanitize.js).
- codewithfourtix#6 Disclosure: one-time Urdu AI/advisory/data-use notice on first
  contact (src/disclosure.js).
- codewithfourtix#7 Abuse: flag repeated near-duplicate fraud-flagged submissions from
  one sender as a probing signal (src/abuse-monitor.js).
- codewithfourtix#8 Escalation: high-emotion verdicts always surface police 15, FIA 1991
  and a "ask a trusted family member first" nudge.
- #12 Feedback: one-tap "was this helpful? (ہاں/نہیں)" after each verdict,
  logged as eval labels (src/feedback.js).

Tests: tests/guardrails.test.js — offline, LLM client stubbed, no paid
API calls. 15 cases covering every guardrail above. `npm test` runs them.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>