fix: reject path traversal in the post id route

[Zhiyilang074811]

What

Fixes #28 - path traversal vulnerability in \GET /<post_id>.

The \�iew_post\ handler previously accepted arbitrary path segments (e.g. ..%2f) and interpolated them directly into a filesystem path, allowing any *.md\ file on the host to be read over HTTP.

Fix

• Add \is_valid_post_id()\ that only accepts [a-z0-9_-]\ characters
• Enforce validation at the request boundary in \�iew_post(), before any filesystem access
• Return 404 for any invalid post_id (same as missing post)
• Add unit tests covering all traversal vectors and the invariant that every \generate_post_id\ output passes the guard

Tests

Added \ est_is_valid_post_id()\ with coverage for:

• Valid slugs (generated posts, static pages, archiver output)
• Rejected traversal vectors (.., ../README, \oo/bar, \oo\\backslash, \post.md, empty, NUL)
• Length bounds (empty string, >250 chars)
• Invariant: all ids \generate_post_id\ can emit pass the guard

Closes #28
Refs: CWE-22, OWASP Path Traversal

[Zhiyilang074811]

This fix is already merged in PR #28. Closing as duplicate.