fix: anchored input patterns end at the last character (/D)

Without /D, "$" also matches before a trailing "\n", so "custom_meta_telefon\n",
a color setting "5\n" (stored as sent) or a whole reference followed by "\n"
passed VariableRef. Added /D to every ^...$ pattern that validates client or
admin input:
- VariableRef META_KEY, NUMBER, WHOLE (canonical/typeOf; Placeholders::field
  shares META_KEY)
- Cursor::decode, GuideRepository topic names (MCP input and filter keys)
- ExposurePolicy::sanitize ability keys and group ids, LogTab list filters

Not changed: Placeholders::PATTERN (runs on trim()), Warnings hex checks (hints
only), NodeSummary/AttrPathIndex/LogListTable (stored or Divi data, no client
input). Each fixed pattern has a test with a trailing "\n" that is rejected.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Abilities/Cursor.php

@@ -27,7 +27,7 @@ final class Cursor
         }
 
         $raw = base64_decode(strtr($cursor, '-_', '+/'), true);
-        if ($raw === false || preg_match('/^o:(\d{1,9})$/', $raw, $matches) !== 1) {
+        if ($raw === false || preg_match('/^o:(\d{1,9})$/D', $raw, $matches) !== 1) {
             return null;
         }
 

src/Abilities/ExposurePolicy.php

@@ -261,7 +261,7 @@ final class ExposurePolicy
                 }
             } elseif (
                 is_string($value)
-                && preg_match('#^[a-z0-9-]+/[a-z0-9-]+$#', $key) === 1
+                && preg_match('#^[a-z0-9-]+/[a-z0-9-]+$#D', $key) === 1
                 && self::isAllowed($key, $value)
             ) {
                 $clean[$key] = $value;
@@ -275,7 +275,7 @@ final class ExposurePolicy
     /** @param list<string>|null $groupIds */
     private static function isGroupId(string $id, ?array $groupIds): bool
     {
-        if (preg_match('#^[a-z0-9-]+$#', $id) !== 1) {
+        if (preg_match('#^[a-z0-9-]+$#D', $id) !== 1) {
             return false;
         }