817690c1b6
Replace character-allowlist regex with an element-token grammar validator. Strip control characters first, then extract the maximal leading run of valid element tokens ([A-Z][a-z]?\d*) and group separators (()[]·.). Fixes: 'C10H12\ninjection' now returns 'C10H12' (was 'C10H12injection'). New: fully invalid inputs (e.g. '<script>alert(1)</script>') return ''. Keep: parenthesised formulas (e.g. 'C2H5(OH)') pass unchanged. Unit tests expanded from 4 to 7 formula cases covering all five DoD requirements plus whitespace-only edge case. PHP not installable in sandbox; all 7 test inputs hand-traced against the regex and confirmed correct via Python simulation. Agent-Session: peptide-schema-backfill v0.6.0 formula-validator