fix(security): validate usage identifiers

[ZaaK0913-coder]

Summary

• Add shared validation for agent and service identifiers used by the usage forms.
• Block empty, whitespace-only, too-long, and malformed identifiers before building usage requests.
• Surface field-level errors through TextField aria-invalid/aria-describedby wiring while preserving required fields and encodeURIComponent on the wire.
• Document the identifier rules in README with a scoped note.

Closes #86

Validation

• npx.cmd jest src/lib/__tests__/validateId.test.ts src/app/usage/page.test.tsx --runInBand
• npx.cmd jest src/lib/__tests__/validateId.test.ts src/app/usage/page.test.tsx --coverage --collectCoverageFrom=src/lib/validateId.ts --collectCoverageFrom=src/app/usage/page.tsx --coverageReporters=text --coverageThreshold "{}" --runInBand
• npx.cmd eslint src/lib/validateId.ts src/lib/__tests__/validateId.test.ts src/app/usage/page.tsx src/app/usage/page.test.tsx
• npx.cmd prettier --check src/lib/validateId.ts src/lib/__tests__/validateId.test.ts src/app/usage/page.tsx src/app/usage/page.test.tsx

Typecheck note

• npm.cmd run typecheck was attempted and is currently blocked by pre-existing main-branch errors outside this change:
  • src/app/agents/[agent]/page.tsx: missing Breadcrumb and formatRequests
  • src/app/docs/page.tsx: missing safeHref