fix(security): VULN-01 admin escalation + VULN-02 path traversal hardening

VULN-01 - Admin privilege escalation:
- Harden register() to reject is_admin=true
- Add /api/setup endpoint with setup_token for initial admin creation
- Add SetupAdminDto and setup_token to AppState
- Remove dead code from auth handler

VULN-02 - Path traversal (CVSS ~8.6):
- Solution A+E: Harden StoragePath constructors (from_string, new, join)
  to strip '..' and '.' segments and reject slash injection
- Solution B: resolve_path() now returns Result<PathBuf>, calls
  validate_path() internally, and verifies resolved path stays under root
- Update StoragePort trait signature to return Result<PathBuf, DomainError>
- Remove dead code: FilePathResolutionPort, StorageVerificationPort,
  DirectoryManagementPort (declared but never implemented)
- Add 17 security tests covering traversal attack vectors

src/application/ports/outbound.rs

@@ -10,8 +10,10 @@ use super::storage_ports::{FileReadPort, FileWritePort};
 
 /// Secondary port for storage operations
 pub trait StoragePort: Send + Sync + 'static {
-    /// Resolves a domain path to a physical path
-    fn resolve_path(&self, storage_path: &StoragePath) -> PathBuf;
+    /// Resolves a domain path to a physical path.
+    ///
+    /// Returns an error if the path contains unsafe segments (defense-in-depth).
+    fn resolve_path(&self, storage_path: &StoragePath) -> Result<PathBuf, DomainError>;
 
     /// Creates directories if they don't exist
     async fn ensure_directory(&self, storage_path: &StoragePath) -> Result<(), DomainError>;