Backend: Add routes-f input sanitizer

## Summary
Implement a server-side input sanitizer for Routes-F payloads.

## Requirements
- Strip or reject HTML/script content.
- Normalize whitespace and trim fields.
- Provide a reusable helper for all routes-f handlers.

## Notes
- Keep logic simple, no heavy dependencies.

## Acceptance Criteria
- Sanitizer is unit tested.
- All routes-f writes use the sanitizer.
