Security: tighten remaining surfaces (Phase 4)

[lohengrin332]

Depends on: Phase 1 (PR)

A collection of smaller findings that individually are low-severity but compound into meaningful risk:

• PID validation (finding fix: broaden rate limit pattern to catch all known Claude messages #22): --stop signals whatever number is in daemon.pid with no verification it belongs to the daemon
• World-readable secrets (finding Support text/document file attachments from Telegram #28): settings.json, session.json, and daemon.pid are created with default umask permissions
• Prompt path traversal (finding feat(api): add message injection endpoint #19): resolvePrompt reads any file on disk, not just paths inside the project directory
• Unbounded log/inbox growth (finding feat: configurable debounce for Telegram messages #29): logs and downloaded attachments accumulate indefinitely
• Attachment size/filename gaps (finding feat: add file/photo sending to Telegram bot #23): no download size cap or filename sanitization before writing to the inbox

Changes:

• Validate PID file contents before signaling in stop/stopAll
• Set mode 0600 on all secret-bearing files at write time
• Sandbox resolvePrompt to the project directory
• Prune logs and inbox on daemon start (configurable age and count limits)
• Reject oversized attachments before download; normalize filenames to safe characters