Harden LAN asset/static path resolution against traversal

[blacks1ne]

Summary

Harden the embedded LAN server's asset/static path resolution and add traversal/symlink regression coverage.

Evidence

crates/klearu-desktop/src/lan_server.rs::handle_asset joins the wildcard request path to data_dir and then uses a lexical starts_with check. Lexical prefix checks do not prove that the filesystem-resolved target remains below the allowed root. The static-file fallback also joins a request path to dist without an explicit descendant check.

This issue intentionally omits a copy-paste exploit path; the risk is the handling of parent components, encoded separators/components, absolute/platform-prefixed paths, and symlinks escaping the served root.

Proposed resolution

• Reject absolute, parent, root, and platform-prefix components before joining.
• Canonicalize the allowed root and existing target, then verify the target is a descendant.
• Define safe behavior for symlinks and missing files.
• Keep the PIN check, but do not treat PIN possession as filesystem-wide read permission.

Acceptance criteria

• Tests cover parent components, percent-encoded variants, mixed separators where applicable, absolute paths, and symlink escape.
• Only files under the intended data/static roots can be served.
• Ordinary gallery assets and SPA fallback behavior continue to work.