fix(render): address #49 review: contents budget, case-insensitive sources, non-Exa snippet bound - #50

The change adds a URL normalisation helper for compact source deduplication and a contents-answer budget, both pure string operations on provider-supplied data with no new sinks, network calls, or secrets. The new tests follow the repository's sibling `*_tests.rs` convention. I found no reportable defect.

No findings.