security: fix path traversal in plugin_rm, add coding tools

- prevent path traversal in ais plugin rm (reject .. and /)
- validate plugin_add requires user/repo format
- extract list_plugins() helper to deduplicate code
- add git aliases (s, d, l, lg, pa for dual push, etc)
- add cargo/rg aliases and mkcd helper to zshrc
- fix zr alias (source instead of unreachable exec)

.gitconfig

@@ -12,3 +12,24 @@
 	defaultBranch = main
 [push]
 	autoSetupRemote = true
+[alias]
+	s = status -sb
+	d = diff
+	ds = diff --staged
+	l = log --oneline -20
+	lg = log --oneline --graph --all -30
+	a = add
+	cm = commit -m
+	co = checkout
+	br = branch -v
+	p = push
+	pa = !git push origin main && git push gitea main
+	f = fetch --all
+	last = log -1 --stat
+	undo = reset --soft HEAD~1
+	amend = commit --amend --no-edit
+	wip = !git add -A && git commit -m 'wip'
+[diff]
+	colorMoved = default
+[merge]
+	conflictstyle = diff3