Security Hardening - API Key Storage and Input Sanitization

[sfloess]

Concerns:

• API keys stored in plaintext via NbPreferences
• No rate limiting
• No input sanitization before sending to LLMs
• No certificate pinning

Recommendations:

• Consider encrypted storage (e.g., NetBeans Keyring or external vault)
• Add basic rate limiting
• Sanitize prompts/context

Priority: High (Security)