pub fn safe_join(base: &Path, path: &str) -> Result<PathBuf>
Safely joins a base path with a relative path, preventing directory traversal.
Validates characters and prevents ../ escape attempts.
../