chore(security): low-severity hardening (log file modes, CLI CSV/grouping, bundled uuid, docs SRI, dev audit) #86

Context

These came out of a security review. Each is low severity on its own, but all are cheap to fix.

What to do

• Log file permissions. FileTransport creates files with the default appendFile/mkdirSync modes (0644/0755 under a typical umask), and logs often contain PII. Create files with mode: 0o600 and directories with 0o700, or add a fileMode option and document it.
• CSV formula injection in the CLI. CSV export (src/cli/commands/export.ts, explore.ts) doesn't neutralize cells starting with = + - @, so a value from the logs becomes a formula when the file is opened in Excel. It also doesn't quote \r. Prefix risky cells with ' and quote CR.
• CLI crash on __proto__/constructor values. query ... COUNT BY <field> (src/cli/commands/query.ts) groups into a plain {}, so a log whose group value is constructor or __proto__ crashes with groups[key].push is not a function. stats.ts uses the same pattern. Use Map or Object.create(null).
• Bundled uuid. uuid@9 is a devDependency, but tsdown inlines it into dist/, so consumers' npm audit can't see it. Replace it with crypto.randomUUID() (Node ≥ 14.17, and available in browsers and workers).
• Docs site. docs/index.html loads https://cdn.tailwindcss.com and highlight.js without a version pin or SRI (CodeQL js/functionality-from-untrusted-source). Pin versions and add integrity.
• Dev dependency audit. npm audit reports multer (high, via @nestjs/platform-express), uuid (moderate) and deepmerge (low, via the jest chain). Bump or add overrides.
• Open CodeQL alerts. Triage the 12 open code-scanning alerts: fix them or dismiss them with a reason.
• dist/.tsbuildinfo is in the published tarball. Exclude it (also tracked in chore(package): align Node version, stop shipping .tsbuildinfo, make reflect-metadata optional #38).

Acceptance criteria

• New log files are created as 0600.
• npm audit is clean, or every remaining finding has a documented reason.
• The CodeQL alert list is empty or triaged.