fix(conversation): validate generated titles

[dom-mp]

Summary

Fixes #34.
The auto-title generator previously accepted the title model output directly, so if the model answered/refused instead of producing a title, that refusal text could be stored as metadata.title and shown in conversation lists.
This PR hardens title generation by:

• Treating the transcript as untrusted data to summarize.
• Wrapping title input in explicit transcript boundaries.
• Escaping injected closing tags in transcript content.
• Sanitizing generated titles before storing them.
• Rejecting refusal, apology, identity-response, and long-prose outputs.
• Falling back to the first user message when the generated title is invalid.

Testing

• bun test test/unit/auto-title.test.ts
• bun run check
• bun run format:check
• bun run lint