MVP: A1 regex validation before serve (ReDoS guard)

Parent: #74

### Scope
Before storing/serving LLM-generated A1 regex, run test_pass/test_fail (or equivalent) and reject catastrophic patterns.

### Files
- `backend/app/services/categorizer.py`
- rule publish path

### Related
Audit §6 in docs/audit/README.md

### DoD
- Unsafe/invalid regex not served to CLI
- Tests for reject path