fix: security hardening — input validation, configurable RPC, error sanitization

[livingproofdev25]

Summary

• Configurable RPC endpoint — Reads SOLANA_RPC_URL env var with fallback to clusterApiUrl("mainnet-beta"), allowing use of private/paid RPC endpoints.
• Base58 input validation — publicKey params now validate base58 format via regex (/^[1-9A-HJ-NP-Za-km-z]{32,44}$/). Transaction signature params validate with /^[1-9A-HJ-NP-Za-km-z]{64,88}$/.
• Bounded dataSize — getMinimumBalanceForRentExemption now restricts dataSize to 0-10,000,000 via .int().min(0).max(10_000_000).
• Sanitized error messages — All 4 tool catch blocks now log errors server-side via console.error() and return a generic message to the client, preventing internal error details from leaking.

Test plan

• Verify npx tsc --noEmit passes
• Verify invalid public key (e.g., "0xinvalid") is rejected by Zod
• Verify dataSize: -1 is rejected
• Verify SOLANA_RPC_URL env var is respected when set
• Verify error responses no longer contain internal exception details

[XaX] https://XautomateX.com