Fix: Path Traversal in preview-server.ts (Arbitrary File Read)

[AmirGhMohseni]

This PR fixes the critical Path Traversal vulnerability reported in issue #381 (comment).

Changes

• Validates and canonicalizes file paths using path.resolve()
• Restricts file access to a safe base directory (SAFE_PREVIEW_DIR)
• Rejects any path containing .. or absolute paths
• Allows only safe file extensions (e.g., .png, .pdf)
• Returns appropriate HTTP errors for invalid requests

Testing

• Added unit tests covering:
  • Valid file access
  • Path traversal attempts (../../../etc/passwd)
  • Invalid extensions
  • Missing parameters

This patch ensures attackers cannot read arbitrary files like .env or internal configs via the preview endpoint.