Security: constrain local file access paths

[BlueVenn6]

Summary

• constrain project-internal paths to approved storage roots, including legacy project asset roots
• require native desktop path approval for create/open/migrate/backup/restore filesystem operations
• use server-generated project, restore, image, and reference asset filenames
• avoid logging security scanner labels or credential-scan result fields that CodeQL treats as sensitive values
• add traversal, absolute-path escape, asset lookup, and desktop path authorization regression tests

Verification

• Python compileall: pass
• Python unittest: 62/62 pass
• frontend ESLint: pass
• Vite production build: pass
• npm audit: 0 vulnerabilities
• repository hygiene check: pass

The DPAPI settings-storage alert is expected to remain until separately reviewed: the value written to JSON is Windows CryptProtectData ciphertext, not plaintext.