fix(security): remove polynomial ReDoS regex in _detect_format (py/polynomial-redos)

The pattern `<[^>]+>\s+<[^>]+>` in _detect_format() was flagged by CodeQL
(py/polynomial-redos, CWE-1333/730/400) as a polynomial regular expression
on uncontrolled user data.

The `<...>` branch was already unreachable — strings starting with '<' return
'xml' two lines above — but CodeQL does not track that control flow path.

Fix: replace the entire re.match() call with plain startswith / 'in' checks:
- N-Triples with URI subjects are already handled by the XML branch.
- Only blank-node-subject N-Triples (_:word <uri> ...) need detection here,
  which is correctly expressed as startswith('_:') and ' <' in stripped.
- Removed the now-unused `import re`.

Closes security advisory #23.

semantica/explorer/routes/ontology.py

@@ -5,7 +5,6 @@ Ontology Hub routes: registry, URL/file loading, preview, creation, entity searc
 import asyncio
 import ipaddress
 import logging
-import re
 import socket
 import uuid
 from datetime import UTC, datetime
@@ -267,7 +266,11 @@ def _detect_format(content: str) -> str:
         return "xml"
     if "@prefix" in stripped or "@base" in stripped:
         return "turtle"
-    if re.match(r"_:\w+|<[^>]+>\s+<[^>]+>", stripped):
+    # N-Triples blank-node subject: "_:word <predicate-uri> ..."
+    # URI-subject N-Triples ("<uri> <uri>") are already caught by the XML
+    # branch above, so only the blank-node form needs to be checked here.
+    # Plain string ops avoid the polynomial regex that CodeQL flags (py/polynomial-redos).
+    if stripped.startswith("_:") and " <" in stripped:
         return "nt"
     return "turtle"