🔒 [security fix] Remove unsafe path canonicalization in directory gate

🎯 What:
Removed filesystem-level path canonicalization in the DataDirGate check (`canon_or_raw`).

⚠️ Risk:
An attacker could bypass directory authorization by creating a symlink to an authorized directory, allowing them to redirect arbitrary path reads/writes via TOCTOU (Time-of-Check to Time-of-Use) attacks or misleading unverified paths.

🛡️ Solution:
Replaced `fs::canonicalize` with purely lexical path normalization (resolving `.` and `..` in memory) to ensure strict string match validation without following symlinks. Ensure relative paths with `..` that go above the start are handled securely without dropping components incorrectly. Added proper Iterator methods to appease clippy.

Co-authored-by: Horizontal42 <75383519+Horizontal42@users.noreply.github.com>

src-tauri/src/main.rs

@@ -50,10 +50,10 @@ fn canon_or_raw(p: &Path) -> PathBuf {
     for component in p.components() {
         match component {
             std::path::Component::ParentDir => {
-                let can_pop = match normalized.components().last() {
-                    Some(std::path::Component::Normal(_)) => true,
-                    _ => false,
-                };
+                let can_pop = matches!(
+                    normalized.components().next_back(),
+                    Some(std::path::Component::Normal(_))
+                );
                 if can_pop {
                     normalized.pop();
                 } else if !normalized.has_root() {