pub fn validate_simple_filename(filename: &str) -> Result<()>
Validate a simple filename: no directories, no traversal, not absolute. Allows [A-Za-z0-9._-] only, must not be empty.