fix: discard_changes path traversal via statuses + dep upgrades

[alari76]

Summary

• High: discard_changes validated paths but not client-supplied statuses keys — when paths was omitted, Object.keys(statuses) became the target list and status: "added" entries flowed to fs.unlink, allowing authenticated arbitrary file deletion outside the repo. Validation now covers every effective target path (both paths and statuses keys) before any git/fs call. Added regression tests.
• High: upgraded multer 2.1.1 → 2.2.0 (GHSA-72gw-mp4g-v24j, GHSA-3p4h-7m6x-2hcm) in both lockfiles.
• Low: transitive body-parser 2.2.2 → 2.3.0 (GHSA-v422-hmwv-36x6) in both lockfiles.

npm audit --omit=dev is now clean in root and server/.

Test plan

• 2497 tests pass, including 3 new traversal tests for statuses keys
• npm run build (typecheck + build) passes
• npm audit --omit=dev reports 0 vulnerabilities in both packages

🤖 Generated with Claude Code

[alari76]

CI run #1276 failed at the Audit dependencies step — npm audit --audit-level=high found 3 high-severity vulnerabilities in root dependencies:

Package	Old	Fixed	Advisory
brace-expansion	5.0.6	5.0.7	GHSA-3jxr-9vmj-r5cp (DoS via exponential-time expansion)
undici	7.24.6	7.28.0	Multiple high CVEs (TLS bypass, header injection, response poisoning, etc.)
vite	8.0.5	8.1.5	GHSA-fx2h-pf6j-xcff (server.fs.deny bypass), GHSA-v6wh-96g9-6wx3
dompurify	3.4.0	3.4.12	Multiple moderate XSS/sanitization bypasses

Fix (7d44e4f): Updated package.json overrides (undici → ^7.28.0, added brace-expansion → ^5.0.7), bumped vite min to ^8.0.16 and dompurify min to ^3.4.12, and regenerated package-lock.json.