feat(custom-widgets): harden AI authoring (credential redaction, JSX policy)

Carve the custom-widget AI-authoring hardening out of #6691 into its own
change, independent of the widget/integration architecture refactor:

- add definition-security redaction helpers that strip credentials/URLs from
  the AI context, response, and generated text
- tighten the authoring prompt and examples
- enforce Tabler icon prop policy in the JSX analyzer
- expand ai-prompt, jsx-policy, and evaluation test coverage

Self-contained in @homarr/custom-widgets; no dependency on the metadata
catalog work. Typecheck + 490 package tests pass.

packages/custom-widgets/src/workbench/code-editor.tsx

@@ -277,7 +277,8 @@ function EditorLoader() {
 function formatCode(value: string, language: "jsx" | "json" | "css") {
   if (language === "json") {
     try {
-      return `${JSON.stringify(JSON.parse(value) as unknown, null, 2)}\n`;
+      const parsed: unknown = JSON.parse(value);
+      return `${JSON.stringify(parsed, null, 2)}\n`;
     } catch {
       return value;
     }