Path traversal through repository names and uploaded filenames

# Path traversal in repository and upload paths

I found path traversal issues in the API where user-controlled repository names and multipart filenames are used to build filesystem paths without validation.

### Repository names

`PUT /v1/repos/a%2Fb` is accepted as:

```text
{"id":12,"name":"a/b","key_id":null}
```

Repository names are later used with `Path::join` in `src/repohdl.rs`.

### Uploaded filenames

`src/api/repos.rs` uses the multipart filename directly:

```rust
let name = field.file_name();
let path = self.dir.join(name);
tokio::fs::File::create(&path).await?;
```

Using:

```text
../../escape-1-1.x86_64.rpm
```

allowed a file to be created outside the configured storage directory.

An absolute filename also caused a server panic at:

```rust
path.strip_prefix(&self.dir).expect("rpm not in repodir")
```

### Impact

An authenticated user who can upload packages can potentially write files outside the intended repository directory, subject to filesystem permissions. Malicious paths can also cause a server panic.

### Suggested fix

Validate repository and uploaded filenames before constructing paths, and ensure the resulting path remains inside the intended storage directory.

Start by reading src/repohdl.rs and src/api/repos.rs to trace how repository names and multipart filenames become filesystem paths. Reproduce the encoded, relative, and absolute path cases described in the issue, then verify that invalid paths are rejected, valid paths stay inside configured storage, and uploads no longer panic.

Written by the indexing model from the issue text.