fix: reject path traversal in the post id route

[netqo]

Closes #27

What

GET /<post_id> (and, by delegation, GET /nojs/<post_id>) interpolated the
URL path parameter straight into content/{post_id}.md with no validation.
Rocket percent-decodes dynamic path segments before the handler runs, so an
encoded ..%2f escaped the content/ directory and let any .md file on the
host be read over HTTP. Confirmed against a proxy-less instance; a
path-normalizing reverse proxy (e.g. Caddy in front of nonogra.ph) happens to
mitigate it, but a directly exposed Rocket -- including the onion service in the
shipped Dockerfile -- is fully affected.

How

• Add is_valid_post_id, which accepts only the [A-Za-z0-9_-] slugs the
  application already produces (generate_post_id emits [a-z0-9-], the static
  pages are lowercase words, and the Telegraph archiver yields
  [A-Za-z0-9_-]). Because ., /, and \ are unrepresentable, a traversal
  sequence can no longer be formed.
• Enforce it at the request boundary in view_post, before any filesystem
  access, returning the normal 404 for anything invalid.

The check is applied once, at the trust boundary between untrusted path input
and the filesystem, rather than scattered across call sites.

Tests

Added unit tests covering:

• accepted slugs (generated posts, static pages, archiver output);
• rejected traversal vectors (.., ../README, ..\README, foo/bar,
  foo.bar, post.md, embedded NUL, empty);
• the length bound;
• the invariant that every id generate_post_id can emit passes the guard, so
  no freshly created post 404s.

Full suite: cargo test -> 144 passed. Manually verified against a running
instance that traversal now returns 404 on all vectors (including /nojs),
while normal pages, raw .md reads, and a round-tripped published post still
return 200.

References

• CWE-22: https://cwe.mitre.org/data/definitions/22.html
• OWASP Path Traversal: https://owasp.org/www-community/attacks/Path_Traversal

[du82]

Will pay bounty to address in this comment: #31 (comment)