feat(ai): extend the prompt injection defense to streamed suggestions

[Reversean]

The one-shot path scans the finished answer before returning it. A stream cannot be checked
that way: it leaves the server while still being written, and a nonce split across two deltas
passes a per-chunk scan untouched.

Add a holdback guard. It withholds the last nonce.length − 1 characters and scans
withheld + new chunk on every delta, releasing only text that cannot be the start of the
nonce. The bound is exact — for the nonce to straddle the send boundary, more than
nonce.length − 1 characters after its first one must already be sent — so every occurrence
falls inside one scanned window and the nonce never reaches the client. Detection itself is
unchanged and shared with the one-shot path.

The guard runs in streamText's experimental_transform, on typed TextStreamPart chunks:
in the encoded SSE bytes the nonce is split by JSON envelopes and escaping, where no substring
search can find it. The withheld tail is released on text-end rather than in the
TransformStream's flush, so deltas stay inside the block they belong to.

stopStream is not used: it requires synthesising finish-step and finish chunks whose
shape is tied to the SDK version. Suppressing text instead keeps the stream well-formed, at
the cost of tokens the model goes on producing unheard — paid only when the tripwire fires.

On detection the guard emits the fallback message once and stays silent, logging eventId
and originalEventId. The prefix already sent cannot be retracted, which is acceptable: the
nonce is what triggered detection and is still withheld when it fires.

The transport takes a StreamGuard port declared in the domain layer and does not know what
a leak is.