fix(ui): keep saved trails inside the project

[danusha2345]

Summary

• reject not-yet-created paths when their nearest existing ancestor is a symlink outside the project
• validate every listed trail through the project-root chokepoint and open it with O_NOFOLLOW
• revalidate the trail directory after creation and use a random, exclusive 0600 temp file for atomic writes
• cache saved-trail authors per real project root and reject declared unknown trail format versions
• replace the parallel-suite wall-clock assertion with deterministic checks plus an isolated median performance gate (npm run test:perf)
• move the test workspace to Vitest 4 test.projects, align the Vite toolchain, and preserve Node >=25 contributor testing
• update the dev dependency graph to zero known audit vulnerabilities

Reproductions fixed

• .codegraph/ui -> outside with missing trails/ previously created outside/trails/<id>.json; the write is now refused.
• .codegraph/ui/trails/leak.json -> outside/secret.json previously exposed a trail-shaped external JSON through the list endpoint; it is now skipped.
• two repositories with different local Git user names in one process previously reused the first author; they now resolve independently.

Positive controls keep projects opened through a safe root symlink and ordinary unversioned hand-written v1 trails working.

Verification

• npm ci
• npm run build
• focused security/UI suites: 139 passed, 3 skipped
• isolated performance suite: 63 passed; warmed five-sample median under 100 ms
• full suite: 4,236 passed, 11 skipped
• npm run build:lib
• npm audit: 0 vulnerabilities
• package dry-run contains dist/viewer/index.html and dist/ui-server/index.js
• compiled read/write/author reproductions all refuse or separate state as expected