review: secure sync_bib/cite split from cookjohn/zotero-mcp#92

[Yyu-ang]

Purpose

Second clean split requested in cookjohn/zotero-mcp#92. This PR is stacked on the citation/export split and contains only the local-file bibliography/draft tools plus their safety controls.

Included

• sync_bib with batched Better BibTeX export
• cite for .tex / .md / .markdown drafts
• independent Citation File Tools preference, disabled unless explicitly enabled
• tools/list hiding and tools/call rejection while disabled
• absolute-path and extension validation for POSIX, Windows drive paths, and UNC paths
• overwrite protection for sync_bib
• existing-draft requirement and explicit marker/append semantics for cite
• tests for path validation and MCP safety gating
• localized preference strings in all shipped locales

Security changes vs original cookjohn#92 implementation

• no arbitrary relative paths
• sync_bib refuses existing files unless overwrite=true
• cite edits only an existing .tex, .md, or .markdown draft
• ambiguous text queries are rejected; itemKey is preferred
• whole-library export is batched (batchSize, default 100) instead of one large fixed-timeout RPC
• file-writing tools have their own default-off gate rather than inheriting the general read tool surface

Validation

• npm ci ✅
• npm run build (zotero-plugin build && tsc --noEmit) ✅
• targeted Prettier on new files ✅
• targeted ESLint on citation implementation/tests ✅
• git diff --check ✅

Final branch is one feature commit on top of split ①.

@cloneorcopy please review this security-focused split before upstream submission.