fix(security): skip an invalid custom pattern regex instead of panicking (#1763)

## Bug

`sensitive_data_detection.custom_patterns[].regex` comes straight from
the user's config file and is not validated when the config loads.
`buildCustomPattern` passes it to `PatternBuilder.WithRegex`, which uses
`regexp.MustCompile`. One malformed regex therefore panics inside
`security.NewDetector`.

`NewDetector` runs at startup (`runtime.go`, `server.go`, `mcp.go`), on
config reload (`ReloadConfig`), and when the credential input screen is
built. A typo in the config means mcpproxy won't start at all. The
validating loader `patterns.LoadCustomPatterns` exists, but it is not on
this path.

## Trigger

```json
"sensitive_data_detection": {
  "enabled": true,
  "custom_patterns": [{"name": "x", "regex": "("}]
}
```

Result: `panic: regexp: Compile(`(`): error parsing regexp: missing
closing ): `(``

## Fix

In `buildCustomPattern`, compile the regex with `regexp.Compile` first
and drop the pattern if it is invalid. This matches how the function
already drops a pattern with no name or no regex/keywords. The other
custom patterns and all built-in patterns are still loaded.

## Test

`TestNewDetector_InvalidCustomRegexIsSkipped` configures one broken and
one valid custom pattern. It asserts that `NewDetector` does not panic
and that the valid pattern still detects `TICKET-123456`.

## Commands run

- `CGO_ENABLED=0 go test -count=1 ./internal/security`: ok
- With the fix reverted (`git stash` of `detector.go`), the new test
fails with `NewDetector panicked on an invalid custom regex: regexp:
Compile(`(`): error parsing regexp: missing closing ): `(``.
- `gofmt -l` on the edited files: no output

Author: rudycelekli

internal/security/detector.go

@@ -1,6 +1,7 @@
 package security
 
 import (
+	"regexp"
 	"strings"
 	"sync"
 	"time"
@@ -344,6 +345,11 @@ func buildCustomPattern(cp config.CustomPattern) *Pattern {
 
 	// Set pattern (regex or keywords)
 	if cp.Regex != "" {
+		// Config is user-edited and not validated on load; an invalid regex
+		// must drop this one pattern, not panic in WithRegex's MustCompile.
+		if _, err := regexp.Compile(cp.Regex); err != nil {
+			return nil
+		}
 		builder.WithRegex(cp.Regex)
 	} else if len(cp.Keywords) > 0 {
 		builder.WithKeywords(cp.Keywords...)

internal/security/detector_custom_regex_test.go

@@ -0,0 +1,39 @@
+package security
+
+import (
+	"testing"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+)
+
+// sensitive_data_detection.custom_patterns comes straight from the user's
+// config file; one bad regex must not take down NewDetector (startup, config
+// reload, credential screen) or the other custom patterns.
+func TestNewDetector_InvalidCustomRegexIsSkipped(t *testing.T) {
+	cfg := config.DefaultSensitiveDataDetectionConfig()
+	cfg.CustomPatterns = []config.CustomPattern{
+		{Name: "broken", Regex: "("},
+		{Name: "ticket", Regex: `TICKET-\d{6}`},
+	}
+
+	var d *Detector
+	func() {
+		defer func() {
+			if r := recover(); r != nil {
+				t.Fatalf("NewDetector panicked on an invalid custom regex: %v", r)
+			}
+		}()
+		d = NewDetector(cfg)
+	}()
+
+	res := d.Scan(`{"note":"see TICKET-123456"}`, "")
+	found := false
+	for _, det := range res.Detections {
+		if det.Type == "ticket" {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("valid custom pattern next to the broken one was not applied: %+v", res.Detections)
+	}
+}