tools: add surface safety audit scripts

What does this PR do

This PR adds two small safety/audit scripts for visible application surfaces.

It does not change runtime behavior. The goal is to make future frontend and user-facing error regressions easier to catch and review.

Changes

1. Add scripts/check-csp-regressions.py

This script scans frontend/ for CSP-hostile patterns such as:

• inline event handlers;
• javascript: URLs;
• eval(...);
• new Function(...);
• string-based setTimeout(...) / setInterval(...);
• inline <script> blocks without src.

Athen now uses a stricter Tauri CSP with script-src 'self'. Inline handlers were already removed from the frontend in a recent commit, so this script helps prevent those patterns from coming back.

2. Add scripts/audit-user-facing-errors.py

This script scans Rust code for likely user-facing raw error surfaces.

It looks for candidate locations where raw error formatting may reach external or user-visible surfaces such as:

• Telegram replies;
• frontend events;
• notifications;
• toast/UI messages;
• user-facing error formatting helpers.

The script is intentionally advisory: it prints candidates for review and exits successfully. Not every raw {e} or .to_string() is unsafe, and not every error type is AthenError, so this should be used as a review aid before making anything blocking.

Why

Athen exposes powerful surfaces: a desktop WebView, Telegram replies, notifications, tool outputs, provider errors, and agent-generated content.

The project already added:

• a baseline Tauri CSP;
• a redaction helper;
• AthenError::user_safe_message();
• secret scanning.

This PR adds lightweight tools to help maintain those safety boundaries over time.

Scope

• No runtime behavior changed.
• No frontend behavior changed.
• No Rust production code changed.
• Adds audit/check scripts only.

Suggested follow-up

After reviewing the audit output, future PRs can:

• wire the CSP checker into CI;
• replace selected user-facing raw error surfaces with user_safe_message();
• make narrower error-surface checks blocking once false positives are understood.