Resolve 13 open code-scanning alerts in namespace-notes (path-injection, SSRF, rate-limiting)

[jhamon]

Theme: Security

Problem

The repo has 13 open code-scanning (CodeQL) alerts, all concentrated in the namespace-notes app. Breakdown by rule and location:

Count	Severity	Rule	Location
9	high	js/path-injection	namespace-notes/server/src/utils/storage/serverStorage.ts
2	critical	js/request-forgery (SSRF)	namespace-notes/client/src/app/api/files/route.ts
1	high	js/path-injection	namespace-notes/server/src/controllers/documentController.ts
1	high	js/missing-rate-limiting	namespace-notes/server/src/routes/documentRoutes.ts

These are real code-scanning findings owned by this audit (distinct from the crit/high Dependabot alerts, which are handled by the separate Security fast-track — see parent issue).

Proposed fix

Resolve each finding at the sink in a way CodeQL recognizes as a sanitizer:

• Path injection (10 alerts) — confine all filesystem paths in serverStorage.ts and documentController.ts to a fixed base directory using a path.resolve + path.relative guard (reject any resolved path that escapes the base with ..). Share one guard helper across every fs sink so the whole class is closed, not just individual lines.
• Request forgery / SSRF (2 critical) — in client/src/app/api/files/route.ts, validate/allowlist the outbound URL host before fetching; reject user-controlled hosts, private/link-local ranges, and non-http(s) schemes.
• Missing rate limiting (1 high) — add rate limiting to the document routes in documentRoutes.ts (e.g. express-rate-limit) as flagged.

Acceptance criteria

• All 13 code-scanning alerts closed (fixed, not dismissed) and CodeQL re-scan shows zero open alerts for these rules.
• Path guard shared across all fs sinks in the server; SSRF allowlist on the files route; rate limiting on public document endpoints.

Blast radius

needs-verification — touches server storage/controller logic and a client API route; verify document upload/retrieval still works end-to-end after hardening.

Dependencies

Best verified once CI exists — Depends on #71 (CI safety net) for lint/typecheck/build gating.