fix: prevent task file path traversal

[lux-liang]

Summary

• Add centralized validation for task IDs and user-controlled path components.
• Prevent traversal and absolute-path writes in /modeling uploads.
• Apply the same protection to /example, /files, /open_folder, and download URL generation.
• Add regression tests for POSIX paths, Windows-style paths, control characters, and symlink escapes.

Security impact

Before this change, UploadFile.filename and task_id were joined directly into filesystem paths. Inputs such as ../../outside.txt, /tmp/file.txt, or ..\\outside.txt could escape the intended task directory.

The new resolver rejects unsafe components and verifies the resolved path remains inside its base directory. Invalid task IDs and filenames are returned as client errors instead of being used as filesystem paths.

Validation

• python3 -m unittest app.tests.test_path_utils
• python3 -m compileall -q app
• uvx ruff check app
• git diff --check

Closes #87
Closes #88