Add asset validation to prevent invalid/malicious content

[bokelley]

Summary

Adds comprehensive asset validation to Wellington to prevent invalid, broken, or malicious assets from being processed in preview_creative and build_creative.

What Changed

• Created src/creative_agent/validation.py with content and security checks
• Integrated validation into both creative endpoints before processing
• Added 47 comprehensive tests achieving 80% coverage of validation code

Security Improvements

Validates all asset types:

• ✅ HTML: Checks for valid tags and document structure
• ✅ CSS: Validates rule syntax
• ✅ JavaScript: Basic content validation
• ✅ Text: Non-empty requirement
• ✅ URLs: Blocks javascript:, vbscript:, file: schemes
• ✅ Images: Format validation, dimension checks, data URI MIME type verification
• ✅ Data URIs: 10MB size limit, restricted to image/* MIME types only

Clear error responses:

{
  "error": "Asset validation failed",
  "validation_errors": [
    "Asset 'headline': Text content cannot be empty",
    "Asset 'background': URL scheme not allowed: javascript"
  ]
}

Before vs After

Before: Wellington accepted dangerous/broken assets

Asset	Old Behavior
asset_type: "html" with content: "not html"	✅ Accepted
url: "javascript:alert('xss')"	✅ Accepted
Empty text content	✅ Accepted
Invalid image formats	✅ Accepted

After: Strict validation with helpful errors

Asset	New Behavior
Invalid HTML	❌ "must contain valid HTML tags"
JavaScript URLs	❌ "scheme not allowed: javascript"
Empty content	❌ "cannot be empty"
Invalid formats	❌ "format not allowed: exe"

Testing

• 47 new validation tests covering all asset types
• All existing tests pass
• Linting and mypy type checking pass

🤖 Generated with Claude Code