[low] files API checks paths lexically, so symlinks can escape the workspace #494

Severity: low

• Verdict: PARTLY (lexical check CONFIRMED; exploit not tested)
• Body: no realpath; a symlink inside the workspace pointing outside allows read, write or delete outside it. Use realpath containment.
• Evidence: src/routes/api/files.ts:50-67.

Source: docs/overnight-2026-10-26/issues-draft.md § C3
Filed from the 2026-10-26 overnight audit (read-only findings, not yet triaged).