fix: sanitize project IDs derived from folder names with dots/special chars

[vanshx999]

When running ao start in a folder whose name contains dots (e.g. llama.cpp), the auto-derived project ID produces a session ID like llama.cpp-1 that fails the session ID pattern [a-zA-Z0-9_-]+.

This sanitizes the project ID at derivation time replacing any character outside [a-zA-Z0-9_-] with a hyphen so llama.cpp becomes llama-cpp and sessions are valid.

Closes #1877