fix(volume-browser): address security review findings

Critical fixes:
- IDOR: verify volume belongs to project before resolving path
- Upload: override global 1MB body limit for upload endpoint (100MB)

High-priority fixes:
- Symlink escape: use filepath.EvalSymlinks in safePath validation
- Remove host filesystem path from browse API response
- Sanitize Content-Disposition filenames, force application/octet-stream
- Strip directory components from upload filenames

web/src/lib/types.ts

@@ -196,7 +196,6 @@ export interface FileEntry {
 /** Response from the volume browse endpoint. */
 export interface BrowseResult {
 	path: string;
-	root: string;
 	entries: FileEntry[];
 }