fix(ai): address security and robustness issues from code review

Security fixes:
- Add escapeUserInput() to prevent Prompt injection via user input
- Validate msgId belongs to dialogId in updateMessageStatus()
- Add type parameter whitelist validation in ai-apply/ai-dismiss
- Add event record validation in task__ai_dismiss

Robustness fixes:
- Use atomic update for markProcessing to prevent concurrent processing
- Add subtask count limit check before creation (max 50)
- Disable similar task feature until vector search is implemented
- Fix Promise anti-pattern in frontend actions

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>

app/Tasks/AiTaskAnalyzeTask.php

@@ -53,8 +53,16 @@ class AiTaskAnalyzeTask extends AbstractTask
                 continue;
             }
 
-            // 标记为处理中
-            $event->markProcessing();
+            // 使用原子操作标记为处理中（防止并发重复处理）
+            $updated = ProjectTaskAiEvent::where('id', $event->id)
+                ->whereIn('status', [ProjectTaskAiEvent::STATUS_PENDING, ProjectTaskAiEvent::STATUS_FAILED])
+                ->update(['status' => ProjectTaskAiEvent::STATUS_PROCESSING]);
+
+            if (!$updated) {
+                // 已被其他进程处理
+                continue;
+            }
+            $event->status = ProjectTaskAiEvent::STATUS_PROCESSING;
 
             try {
                 // 检查是否满足执行条件