fix: critical bug fixes from codebase audit

[code-by-mahereddy]

Bug Fixes from Codebase Audit

Critical

• LIKE pattern bug (store.c): Double-percent format string produced wrong SQL LIKE pattern, making find_edges_by_url_path always fail
• Use-after-free (store.c): like_pool_add could free pointer, but subsequent code still used it
• Memory leak (cypher.c): expr_free silently dropped subtrees when 128-entry stack overflowed

High

• Path traversal (store.c, mcp.c, http_server.c): Project names were not validated before interpolation into file paths
• JSON-RPC 2.0 violation (mcp.c): Response missing both result and error keys when both were NULL
• Buffer overflow (mcp.c): collect_db_project_names offset could exceed buffer size on truncation
• XSS (http_server.c): Directory names injected raw into JSON without escaping
• NULL checks (store.c): Missing NULL guards on cbm_store_checkpoint, cbm_store_node_degree, cbm_store_restore_from

New utility

• cbm_validate_project_name() in str_util.c/h — validates project names are safe for file path construction

All fixes verified with successful build (make -f Makefile.cbm cbm with -Werror).