fix(security): improve JSON output safety and path traversal protection

- [x] Replace unsafe JSON string formatting with proper json.Marshal in export handler
- [x] Remove escapeJSONString helper function in favor of standard JSON marshaling
- [x] Add safeResolvePath function to validate paths and prevent directory traversal
- [x] Apply path traversal validation in captureFileMtimes operations
- [x] Cap result slice capacity in getRecentSearchQueries to prevent DoS via excessive allocation

internal/mcp/server.go

@@ -2620,8 +2620,21 @@ func (s *Server) handleExportObservations(ctx context.Context, args json.RawMess
 			}
 			lines = append(lines, string(line))
 		}
-		output = fmt.Sprintf(`{"format":"jsonl","count":%d,"data":"%s"}`,
-			len(observations), escapeJSONString(strings.Join(lines, "\n")))
+		// Use proper JSON marshaling to avoid injection issues
+		jsonlOutput := struct {
+			Format string `json:"format"`
+			Data   string `json:"data"`
+			Count  int    `json:"count"`
+		}{
+			Format: "jsonl",
+			Count:  len(observations),
+			Data:   strings.Join(lines, "\n"),
+		}
+		outputBytes, err := json.Marshal(jsonlOutput)
+		if err != nil {
+			return "", fmt.Errorf("marshal jsonl output: %w", err)
+		}
+		output = string(outputBytes)
 
 	case "markdown":
 		// Markdown format for human reading
@@ -2685,16 +2698,6 @@ func (s *Server) handleExportObservations(ctx context.Context, args json.RawMess
 	return output, nil
 }
 
-// escapeJSONString escapes a string for use in JSON.
-func escapeJSONString(s string) string {
-	b, _ := json.Marshal(s)
-	// Remove surrounding quotes
-	if len(b) >= 2 {
-		return string(b[1 : len(b)-1])
-	}
-	return s
-}
-
 // handleCheckSystemHealth performs comprehensive system health checks.
 func (s *Server) handleCheckSystemHealth(ctx context.Context) (string, error) {
 	type SubsystemHealth struct {