feat(security): harden input sanitization and expand blocked domains

- Escape backticks in `sanitizeInput` to prevent template injection risks
- Add `sharklasers.com` and `guerrillamail.net` to blocked email domains
- Update `src/utils/security.test.ts` with new test cases

Co-authored-by: ragusa-it <196988693+ragusa-it@users.noreply.github.com>

.jules/sentinel.md

@@ -27,3 +27,8 @@
 **Vulnerability:** Allowing users to register or submit forms with disposable email addresses (e.g., mailinator.com) can lead to spam, abuse, and polluted data.
 **Learning:** While true email verification requires a backend or API, a simple client-side blocklist of common disposable domains is a highly effective, low-cost first line of defense.
 **Prevention:** Maintain a list of known disposable domains (e.g., `BLOCKED_DOMAINS`) and check the domain part of the email address during validation.
+
+## 2026-02-14 - Incomplete Sanitization Implementation
+**Vulnerability:** Security utilities (`sanitizeInput`) did not fully implement the documented protection (missing backtick escaping), and blocklists were incomplete.
+**Learning:** Documentation and guidelines (even memories) can diverge from implementation. Regular audits are necessary to ensure the code actually matches the security specifications.
+**Prevention:** Add specific unit tests for every character and domain in security specifications to prevent regression or incomplete implementation.