fix: prevent path traversal in search path parameter

[echobt]

This PR fixes a path traversal vulnerability where the path parameter in search requests could be used to access files outside the intended directory.

Changes:

• Validates that the resolved search path starts with the current working directory (or allowed root).
• Applies validation in both the Server API (src/server/api.rs) and the Core Search Engine (src/core/search.rs).
• Returns a 400 Bad Request if a traversal attempt is detected in the API.
• Prevents silent fallback to malicious paths when canonicalization fails, by enforcing the scope check on the resolved path.

Security Impact:
Prevents attackers from using ../ sequences to search or enumerate files outside the indexed/server directory.