- Add stdin.go with ReadStdinIfPiped and ReadFileArg helpers
- Support @file syntax for --json flag to read payload from file
- Fall back to stdin pipe when no --json argument is provided
- Add internal/validate with control char rejection, ANSI stripping,
URL query/fragment stripping, and terminal sanitization
- Refactor output/sanitize.go to delegate to validate package
- Update sanitize test to reflect ANSI escape stripping behavior