fix(cli): sanitize terminal output

[zoya-brd]

Fixes unsafe terminal output when API-controlled values contain escape/control characters.
The changes:

• sanitize untrusted values when printing to a TTY

• sanitize and flatten values in print_table() before calculating column widths

• preserve raw output when stdout is piped or redirected

• make the TTY check dynamic

• add tests for TTY sanitization, redirected output, and malicious table values

• bump version to 0.3.6

[artemo-brd]

Please fix the items below:

• Incomplete coverage. print() is sanitized, but print_table() still writes API-controlled values directly via console.log(). (e.g. discover titles and URLs). Please audit other direct console.log/error and stdout/stderr.write paths, and sanitize untrusted values before applying CLI styling (e.g. success/warn/info/fail functions).

• Do not sanitize non-TTY stdout. The current change makes -o file preserve escapes while > file and pipes strip them, potentially corrupting raw/CSV/MD/HTML output. Sanitize only when is_tty. Please also transform is_tty to function (const is_tty = () => process.stdout.isTTY === true;) because currently it's not a live check and tests can't flip it after import. This constant is used in other files (spinner.ts, discover.ts, scraper.ts), so it needs to be updated there as well.

• Add tests for:

1. sanitized TTY output
2. preserved piped/redirected output
3. malicious values passed through print_table()

Also stripVTControlCharacters() doesn't handle standalone controls such as \r, \b, \x07.
Suggested:

const sanitize_terminal = (value: string): string =>
    stripVTControlCharacters(value)
        .replace(/\r\n?/g, '\n')
        .replace(/[\x00-\x08\x0B-\x1F\x7F-\x9F]/g, '');

Normalize carriage return before applying the character class.
In print_table(), sanitize and flatten cells before computing widths to not break table alignment.

[artemo-brd]

ansi() decides on colors via process.stdout.isTTY, but success/warn/info/fail write to stderr it might cause 2 bugs:

• cmd | jq - stdout is a pipe, stderr is still a TTY -> diagnostics lose color.
• cmd 2>error.log - stdout is a TTY, stderr is a file -> raw \x1b[33m writes in the log file.

Suggested fix:

const is_tty = ()=>process.stdout.isTTY === true;
const is_tty_err = ()=>process.stderr.isTTY === true;

const ansi = (code: string, text: string, tty = is_tty())=>
    tty ? `\x1b[${code}m${text}\x1b[0m` : text;

const green = (s: string, tty?: boolean)=>ansi('32', s, tty ?? is_tty());
const red = (s: string, tty?: boolean)=>ansi('31', s, tty ?? is_tty());
const yellow = (s: string, tty?: boolean)=>ansi('33', s, tty ?? is_tty());
const dim = (s: string, tty?: boolean)=>ansi('2', s, tty ?? is_tty());

const warn = (msg: string)=>
    console.error(yellow(`⚠ ${terminal_safe(msg)}`, is_tty_err()));
// same for success / info / fail

We can skip it for now, it's not a blocker. Maybe it's a case for another request

[artemo-brd]

We can replace \n and \t always here to not break the table (no need to check if tty)