Portfolio: shared field rules, username rules and reserved names #42

Part of #40. Depends on #41.

Scope

Create one source of rules that both runtimes use, the same way shared/practice/questions.json works.

• Fields and limits: name, headline, about, skills, projects (title, link, tech, description), education, experience, achievements, and links (GitHub, LinkedIn, website, email). Set a maximum length for each text field and a maximum number of projects and entries.
• Links: https only, plus mailto: for email. Follow the approach of sanitizeUrl in src/lib/markdown.ts.
• Username: lowercase letters, digits and single hyphens, 3 to 30 characters.
• Reserved names: www, api, app, admin, mail, docs, blog, login, support, help, procoderji, satyam, and existing route names such as u, learn, practice, account.
• Blocked words that suggest phishing, such as paytm, bank, login, verify, password.
• A TypeScript validator in src/features/portfolio/ and a .NET validator in the backend, tested against the same fixtures.

Done when

• npm test and dotnet test backend/ProCoderJi.slnx --configuration Release cover valid and invalid portfolios and usernames.
• The limits are documented for contributors.