fix(notifications): validate Twilio AccountSid format at save — closes the un-escaped URI interpolation door

Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj

src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Pages/Notifications/SmsConfiguration.razor

@@ -226,6 +226,15 @@
             return;
         }
 
+        // The AccountSid is interpolated un-escaped into the Twilio request URI, so reject
+        // any malformed SID client-side too (the ManagementActor enforces the same guard
+        // server-side; keep the message identical).
+        if (!System.Text.RegularExpressions.Regex.IsMatch(_accountSid.Trim(), "^AC[0-9a-fA-F]{32}$"))
+        {
+            _formError = "Account SID must match Twilio's format: 'AC' followed by 32 hex characters.";
+            return;
+        }
+
         var typedAuthToken = string.IsNullOrWhiteSpace(_authToken) ? null : _authToken.Trim();
 
         try