Function validate_schema_path 

pub fn validate_schema_path(
    path: &str,
    allowed_base: Option<&Path>,
) -> Result<(), ApiError>

Validate that a caller-supplied schema path is safe to open.

Two threats are guarded against:

1. Path traversal — any component equal to .. would let an attacker escape the intended directory, so such paths are rejected.
2. Absolute-path escape — when an allowed_base is given, the resolved path must start with that prefix. An absolute path like /etc/passwd is rejected when the allowed base is /var/fraiseql.

Errors

Returns ApiError with a validation error when the path is unsafe.