feat(security): add input sanitisation middleware (mongoSanitize and xss-clean)

[tmrathod2003-alt]

Implements input sanitisation middleware to protect the backend against NoSQL injection and XSS attacks. Currently the app accepts raw user input without sanitisation, leaving it vulnerable to malicious payloads. This adds a security layer that sanitises all incoming requests before they reach the route handlers.

Changes:
Installed express-mongo-sanitize to strip MongoDB operators from request inputs
Installed xss-clean to sanitise HTML tags and prevent XSS attacks
Updated src/index.js to apply mongoSanitize() and xss() middleware globally

Testing:
Sent NoSQL injection payload {"$gt": ""} to /api/reports — blocked by Zod validation (email must be string)
Sent XSS payload <script>alert('xss')</script> to /api/reports without middleware — script tag stored as-is (vulnerable)
Sent same XSS payload with middleware enabled — script tag converted to <script> (sanitised) ✅
Sent NoSQL injection payload {"$gt": ""} to /api/reports without middleware — $gt operator stored as-is (vulnerable)
Sent same NoSQL payload with middleware enabled — $gt operator stripped to {} (sanitised) ✅