Path traversal: startsWith check without path.resolve() in file endpoint

[consigcody94]

Found via code audit. packages/backend/src/routes/files.ts:96-99. No canonicalization before prefix check. Fix: path.resolve(absPath).startsWith(path.resolve(projectPath) + path.sep)