feat(volume-browser): absolute scope with allowlist security

- Add 'absolute' volume scope for direct host paths (NFS, external mounts)
- Allowlist in settings: allowed_volume_paths (JSON array of prefixes)
- Validation: absolute source must be under an allowed prefix
- Empty allowlist = absolute scope disabled entirely
- Settings API exposes/validates allowed_volume_paths
- Frontend type updated with absolute scope

internal/api/volume_browser.go

@@ -74,10 +74,11 @@ func (s *Server) resolveVolumeRoot(w http.ResponseWriter, r *http.Request) (stri
 
 	q := r.URL.Query()
 	params := volume.ResolveParams{
-		BasePath:    settings.BaseVolumePath,
-		ProjectName: proj.Name,
-		StageName:   q.Get("stage"),
-		ImageTag:    q.Get("tag"),
+		BasePath:           settings.BaseVolumePath,
+		ProjectName:        proj.Name,
+		StageName:          q.Get("stage"),
+		ImageTag:           q.Get("tag"),
+		AllowedVolumePaths: settings.AllowedVolumePaths,
 	}
 
 	rootPath, err := volume.ResolvePath(vol, params)