fix: keep disk proxy reads inside proxy root

[sagarmaurya64-ai]

Fixes a disk proxy path containment issue.

The disk proxy previously joined the configured proxy root with the requested relative path without verifying the resolved result stayed inside the proxy root. This patch resolves both paths, checks the relative path remains within the root, and returns the existing 404 response for out-of-root requests.

Verification:

• npx tsc --noEmit
• npx --yes bun test tests/routes/file-proxy02.test.ts

[sagarmaurya64-ai]

Thanks for reviewing. I noticed the download endpoint was already present, so I audited the disk proxy handling and added a small containment fix with a regression test.

[sagarmaurya64-ai]

Hi maintainers, thanks for taking a look.

I noticed the original download endpoint work was already implemented, so I audited the related disk proxy code and found a path containment issue. This PR adds a small security fix and regression test to prevent disk proxy reads from escaping the configured proxy root.

Would this qualify for a bounty/reward, or should I link it to a separate issue?