fix: FTS5 injection, N+1 queries, and code quality audit

[sdsrss]

Summary

• [C1] Fix FTS5 query injection: Strip metacharacters (* ^ : + - ~ " ( ) { }) from search terms, keeping only alphanumeric and underscore characters to prevent FTS5 operator injection
• [I5] Eliminate N+1 queries: Add get_nodes_with_files_by_name() batch query with JOIN, replacing per-node get_file_path() calls in disambiguate_symbol and tool_get_ast_node
• [I4] Optimize incremental index: Replace O(N) filesystem exists() stat calls with DirectoryCache::file_exists() which uses already-collected mtime data
• [I1] BufReader for read_source_context: Read files line-by-line instead of loading entire file into memory
• [I2/I3] Document lock ordering and write-access model: Add safety documentation for Mutex ordering and SQLite WAL concurrent access
• [S4] Extract compute_risk_level: Deduplicate risk assessment logic from 3 locations into domain::compute_risk_level()
• [S5] Enhance is_test_symbol: Cover Go, Rust, TS, JS, JSX, TSX test file conventions
• [S1] Replace glob import: Use explicit imports in pipeline.rs

Test plan

• cargo check --no-default-features — clean
• cargo test --no-default-features — 220 tests pass
• cargo build --release — clean
• CI pipeline passes

🤖 Generated with Claude Code