fix: prevent path traversal in /api/upload (Fix 1)

[cchwala]

• Apply secure_filename() before any filename manipulation
• Move ALLOWED_EXTENSIONS and MAX_FILE_SIZE constants to top of file
• Add app.config[MAX_CONTENT_LENGTH] for WSGI-level size enforcement
• Guard against oversized uploads via Content-Length before writing to disk
• Return safe_name (sanitised) as original_filename in response

[codecov]

Codecov Report

❌ Patch coverage is 33.33333% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.82%. Comparing base (37cbc64) to head (8396825).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
webserver/main.py	33.33%	8 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #38      +/-   ##
==========================================
- Coverage   78.93%   78.82%   -0.12%     
==========================================
  Files          24       24              
  Lines        2317     2323       +6     
==========================================
+ Hits         1829     1831       +2     
- Misses        488      492       +4     

Flag	Coverage Δ
mno_simulator	86.72% <ø> (ø)
parser	85.48% <ø> (ø)
webserver	48.87% <33.33%> (-0.22%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.