Function sanitizeServerText

Make a string that originates in an attacker-controlled response body — the error detail snippet that ends up in a HochwasserzentralenApiError.message printed to stderr by run.ts — safe to print:

• C0 and C1 controls and DEL are dropped. Without this, a hostile / MITM'd / spoofed---base-url endpoint could drive ANSI/OSC escape sequences (display spoofing, terminal title changes) into the user's terminal via a non-2xx reply.
• Bidi formatting characters (isBidiControl) are dropped, so server text cannot reorder the visible message.
• Every run of whitespace — newlines, tabs, U+2028/U+2029 included — becomes one space and the ends are trimmed, so the text stays on one line and a server cannot forge an Error: line of its own.

This only covers error text: the CLI's JSON/GeoJSON output is escaped separately (escapeControlChars in cli/shared.ts), since JSON.stringify alone leaves DEL, the C1 range and the bidi characters raw.

Written as a char-code filter so no raw control byte ever appears in this source.