fix: code audit — security, correctness, and robustness fixes

Security:
- Path traversal: validate user_id, case_id, skill_name against safe regex
- Input sanitization in memory.py and skills.py file path construction

Correctness:
- ISR timezone: replace hardcoded UTC+3 with ZoneInfo("Asia/Jerusalem") for DST
- save_rule: use EspoCrmApiError.status_code instead of fragile string matching
- Background tasks: store references to prevent GC before completion
- Lock race: use dict.setdefault() for atomic lock creation
- Version: health.py now matches main.py (0.2.0)
- Skill names: normalized to lowercase for dedup consistency

Build:
- Dockerfile: install from pyproject.toml instead of hardcoded pip list
- Remove unused mcp>=1.0.0 dependency from pyproject.toml

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

api/services/prompt_builder.py

@@ -2,7 +2,8 @@
 
 from __future__ import annotations
 
-from datetime import datetime, timezone, timedelta
+from datetime import datetime
+from zoneinfo import ZoneInfo
 
 VALID_STATUSES = {
     "New": "חדש",
@@ -19,7 +20,7 @@ VALID_STATUSES = {
     "Rejected": "נדחה",
 }
 
-ISR_TZ = timezone(timedelta(hours=3))
+ISR_TZ = ZoneInfo("Asia/Jerusalem")
 
 TOOL_RULES = (
     "TOOL RULES (CRITICAL — you MUST follow these):\n"