fix(media): contain media file resolution inside the store (CWE-22 path traversal)

[DHDHLZ]

Security fix: GET /api/media/:date/:name allowed arbitrary file disclosure.

What: URL segments were joined into the media path without a containment
check; Hono percent-decodes route params, so a request such as
GET /api/media//..%2F..%2Fconfig%2Fauth.json read files outside the
store (auth.json, accounts.json with broker credentials, and any file
readable by Alice).

Fix:

1. resolveMediaPath now rejects any result outside MEDIA_DIR (path.relative fence);
2. the media route only serves known media extensions and answers traversal with 404;
3. regression specs cover both the fence and the route behaviour.

Verified:

• npx vitest run --project node src/core/media-store.spec.ts src/webui/routes/media.spec.ts (12 passed)
• npx tsc --noEmit
• local live check: the traversal request returns 404 after the fix (was 200 before)

[vercel]

@DHDHLZ is attempting to deploy a commit to the luokerenx4's Team Team on Vercel.

A member of the Team first needs to authorize it.