🛡️ Sentinel: [CRITICAL] Fix ReDoS and info leak in API

[hadsern]

🚨 Severity: CRITICAL
💡 Vulnerability:

1. ReDoS: Unescaped user query input was passed directly into new RegExp(), leaving the API susceptible to resource-exhaustion attacks from malicious payloads.
2. Information Leak: The API endpoint was responding to 500 status requests with exact error details (error.message), which could expose sensitive internal server/stack information.
   🎯 Impact: Malicious actors could perform a Denial of Service attack using complex regular expression string payloads causing the Node.js event loop to block, leading to server unresponsiveness. Furthermore, explicit error messages could leak environment, database, or network implementation details useful for reconnaissance.
   🔧 Fix:
3. Replaced the new RegExp match evaluation with a purely string-based indexOf loop counting occurrences safely, with bounds checking to avoid infinite loops.
4. Stripped the details field returning error.message from the 500 JSON response explicitly.
   ✅ Verification: Verified by checking that contentMatches accurately uses indexOf logic and by asserting that the Failed to process question error block only returns the generic error without the internal details field. Ran tests and build check.

---

PR created automatically by Jules for task 11561901099064455664 started by @hadsern

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.