Validate app-server read file paths

[OnlyYu1996]

Summary

• validate app-server /files/read paths with the existing path safety helper before checking or reading files
• read from the validated canonical path so disallowed absolute/system paths are rejected instead of exposed
• add regression coverage for allowed temp reads and rejected Unix system paths

Fixes PlatformNetwork/bounty-challenge#53217.

Validation

• cargo fmt --package cortex-app-server --check
• cargo test --package cortex-app-server api::files -- --nocapture
• cargo test --package cortex-app-server -- --nocapture
• cargo check --package cortex-app-server --lib
• git diff --check

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.