fix(security): block path traversal via symlinks in /api/file and rea…

fix(security): block path traversal via symlinks in /api/file and rea… #7