feat: unified LLM/Cypher hardening (timeouts, provider fallback, tests)

[omakszewska]

Unified LLM/Cypher hardening (replaces #39 and #40).

• Cypher: read-only validation before Neo4j (block writes, strip fences, enforce LIMIT)
• Timeouts: configurable LLM + graph timeouts (env/yaml); wired into MCP RAG, MCP client, and ToPWR API final-answer LLM
• Fallback: OpenAI → DeepSeek → Google via LangChain with_fallbacks on transient errors
• Guardrails: JSON decisions (generate / end), fail-closed to end
• Tests: unit tests for Cypher guardrails and provider fallback / exception routing
  No tenacity — resilience is provider switch, not retrying the same provider.

Closes #28

[omakszewska]

@Dominik-Galus can you please review this PR?