Validate journal dates before vault mutations

[levineam]

Motivation

• The routing path accepted arbitrary capture.date strings that reached path.join(journalDir, ${date}.md), allowing ../ traversal and writes outside the configured journal root.
• The intent of the change is to enforce the documented YYYY-MM-DD journal filename contract before any vault mutation and prevent untrusted input from being used to construct filesystem paths.

Description

• Add a validateJournalDate(date) helper to modules/jarvos-secondbrain/adapters/obsidian/src/vault-storage-adapter.js that throws unless date matches /^\d{4}-\d{2}-\d{2}$/.
• Call validateJournalDate(date) at the start of ensureJournal so all journal-creation and append flows validate the date before building journalPath or performing any mutation.
• Add a regression test test('journal dates reject path traversal before performing a mutation', ...) to modules/jarvos-secondbrain/tests/vault-storage-adapter-journal.test.js that asserts malformed/traversal dates are rejected and no storage operations occur.
• Preserve default behavior when no date is supplied (still uses the existing todayDate() formatting).

Testing

• Ran git diff --check to verify no whitespace/format issues and it passed.
• Ran node --test modules/jarvos-secondbrain/tests/vault-storage-adapter-journal.test.js modules/jarvos-secondbrain/tests/keyword-capture-router.test.js and all tests passed (9 tests, 0 failures).

---

Codex Task