Fix critical bugs, security vulnerabilities, and add tests

[RFingAdam]

Summary

Comprehensive fixes from deep code review addressing 30+ issues across security, RF engineering correctness, VBA generation, and code quality.

Critical fixes

• CRITICAL: Cylinder axis parameter ignored — Zrange always used regardless of axis #22 Cylinder/cone axis parameter ignored — now maps to correct CST VBA range property
• CRITICAL: Transform VBA property names have spaces — invalid CST VBA #23 Transform VBA property names had spaces (Origin X → OriginX) — invalid CST VBA
• CRITICAL: Plane wave excitation sets Normal to polarization type string #24 Plane wave set Normal to polarization string — now sets propagation axis + separate polarization
• CRITICAL: cst_export_result CSV/TXT format completely broken — VBA blocked by own validator #25 CSV/TXT export was blocked by own VBA validator — rewritten to use CST ASCIIExport
• CRITICAL: Slot antenna never cuts slot — missing Solid.Subtract #26 Slot antenna never subtracted the slot — added Solid.Subtract
• CRITICAL: Horn antenna loft profiles lack Z-positioning — both at z=0 #27 Horn antenna loft profiles both at z=0 — now uses Polygon3D with Z-coordinates
• VBA injection: unescaped user input in parameters.py, project.py, results.py #28 VBA injection via unescaped user input in parameters, project, results

Security fixes

• VBABuilder .set() does not scan for dangerous patterns #14 _escape_vba_string() now blocks string concatenation injection (" & Shell(...))
• Gerber import missing validate_file_path() — path traversal possible #33 Gerber import missing validate_file_path() — path traversal possible
• Windows absolute paths bypass work_dir containment in validate_file_path() #34 Windows absolute paths (C:\...) bypassed work_dir containment

High-priority fixes

• Yagi antenna: reflector spacing 0.25λ should be 0.20λ #3 Yagi reflector spacing: 0.25λ → 0.20λ (NBS/Viezbicke)
• PCB microstrip: effective permittivity exponent incorrectly scaled by f_u #4 Microstrip effective permittivity exponent incorrectly scaled by f_u
• ToolRegistry singleton re-registration bug: duplicate tools on repeated register_all_tools() #5 ToolRegistry duplicate registration on repeated register_all_tools()
• Inconsistent error handling across tool modules #10/Error response format inconsistency: 'error' key vs 'status'+'message' pattern #21 Consistent {"status": "error", "message": "..."} format across all handlers
• substrates.json never loaded — cst_list_materials(category='substrates') returns wrong data #29 substrates.json never loaded — cst_list_materials(category='substrates') fixed
• Parameter sweep hardcodes SimulationType='Transient' regardless of project solver #30 Parameter sweep hardcoded SimulationType='Transient' — now configurable
• Optimizer VBA structure invalid for CST API #31 Optimizer VBA restructured to match CST API (SelectParameter/AddSelectedParameter)
• Field monitor uses non-existent CST VBA property 'Dimension' #32 Field monitor used non-existent Dimension property — removed
• Patch R_edge: ZeroDivisionError when eps_r = 1.0 (air substrate) #38 Patch R_edge division by zero when eps_r = 1.0

Medium/low fixes

• Nickel mu_r=600 in material database is misleading for RF applications #11 Nickel mu_r=600 note clarified | PCB stripline Cohn formula constant: 94.15 should be 94.25 #12 Stripline constant 94.15 → 94.25
• numpy declared as dependency but never imported #35 numpy dependency removed (unused) | _TOOL_NAMES defined but never used in any module — dead code #36 Dead _TOOL_NAMES removed
• Units block missing .Apply() — unit changes may not be committed in CST #37 Units block .Apply() added | Via tool: pad/antipad geometry not generated despite description claiming it #39 Via description corrected
• Bowtie: flare_angle description says 'half-angle' but code halves it again #40 Bowtie flare_angle description fixed | VSWR calculation: ZeroDivisionError when |S11| = 1.0 #41 VSWR |S11|=1 guarded

Testing & quality

• 15 new test files covering previously untested modules (205 tests, all passing)
• PyPI metadata added (URLs, classifiers)
• Wheeler feed width formula corrected

Test plan

• All 205 tests pass (pytest tests/ -v)
• Verify cylinder axis mapping generates correct VBA for x/y/z axes
• Verify horn antenna loft creates 3D profiles at different Z positions
• Verify slot antenna VBA includes Solid.Subtract call
• Verify plane wave VBA sets Normal "z" and Polarization separately
• Verify CSV/TXT export uses ASCIIExport instead of file I/O
• Verify VBA injection blocked in parameter names with special chars
• Verify Windows paths like C:\temp\file.cst rejected outside work_dir

Closes #3, #4, #5, #10, #11, #12, #14, #22, #23, #24, #25, #26, #27, #28, #29, #30, #31, #32, #33, #34, #35, #36, #37, #38, #39, #40, #41

🤖 Generated with Claude Code