fix(security): prevent path traversal and symlink attacks in IndexExportJob

[marevol]

Summary

• Strip . and .. path components and normalize resolved paths in buildFilePath() to prevent directory traversal attacks
• Validate that resolved file paths stay within the export base directory, falling back to _invalid/ directory for malicious URLs
• Add symlink traversal prevention in exportDocument() by resolving real paths and using NOFOLLOW_LINKS when writing files
• Add comprehensive tests for path traversal and symlink attack scenarios

Test plan

• Verify existing IndexExportJobTest tests pass
• Verify new path traversal prevention tests pass (dot-dot, encoded, backslash variants)
• Verify new symlink traversal prevention tests pass (intermediate dir symlink, leaf file symlink)

🤖 Generated with Claude Code