fix(server): address review — path.delimiter for cross-platform roots, path.relative containment, resolve-error message

- Split ATTACHMENT_ALLOWED_ROOTS on path.delimiter (':' POSIX, ';' Windows)
  so Windows drive-letter paths are not broken by the colon split.
- Containment check via path.relative instead of startsWith(root + sep),
  fixing the filesystem-root edge case ('/' or 'C:\') and staying
  platform-agnostic.
- Wrap realpathSync(filePath) in try/catch for a descriptive rejection
  when the attachment path cannot be resolved.
- Tests join roots with path.delimiter.

Author: Federico Liva