Harden URI-decoded path normalization for MCP and DB paths

[Widthdom]

Found while dogfooding the locally built cdidx on branch codex/search-audit-issues-20260619.

Duplicate check: no open issue found for URI decoded path normalization MCP resources roots DB paths double unescape.

Evidence:

• src/CodeIndex/Mcp/McpServer.cs:2491 decodes cdidx://file/... with Uri.UnescapeDataString after URI parsing.
• src/CodeIndex/Mcp/McpToolHandlers.cs:5420 resolves client root file URIs by unescaping uri.LocalPath before Path.GetFullPath.
• src/CodeIndex/Cli/DbPathResolver.cs:251 handles relative file: DB paths by unescaping and normalizing.

Problem:
Path-bearing URI flows should have one clear decode and normalization policy. Multiple URI APIs can already return decoded local paths, so ad hoc unescape calls risk double-decode behavior or inconsistent rejection of encoded separators and traversal markers.

Acceptance criteria:

• Centralize decode/normalize validation for MCP resource URIs, MCP client roots, and SQLite file URI DB paths where practical.
• Reject encoded traversal/rooted path forms consistently.
• Add tests for %2f, %5c, %2e%2e, already-decoded spaces, and platform separators.