Guardrail layer against injected instructions

Add input validation rejecting prompt-injection patterns found in retrieved content - for example a document containing "ignore previous instructions" - and output validation that blocks answers below a confidence threshold from being shown without a low-confidence banner.

Retrieved documents are untrusted input. This is the defining security property of RAG and the one most systems get wrong: the corpus is treated as data right up until its text lands in a prompt, where it silently becomes instructions.