Sanitize inputs and harden network security

[LeonardSEO]

Summary

• sanitize banner content, MCP configuration descriptions, and agent marketplace cards with DOMPurify
• restrict CORS to an allow-list and validate custom endpoint URLs
• enforce size/time limits on remote file downloads, extract filename validation into utils
• serialize MCP reinitialization and sanitize custom headers
• hash Anthropic user identifiers and clarify CORS origin examples in .env.example

---

Change Type

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update
• Translation update

---

Testing

Test Configuration:

• ✅ npm run lint
• ❌ npm run test:api – Cannot find module @librechat/data-schemas
• ❌ npm run test:client – Cannot find module librechat-data-provider (MongoDB download issue)

---

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have commented in any complex areas of my code
• I have made pertinent documentation changes
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective or that my feature works
• Local unit tests pass with my changes
• Any changes dependent on mine have been merged and published in downstream modules
• A pull request for updating the documentation has been submitted

---