Path traversal in the visualization static file handler

## Context

`RestAPIServer::handleStaticFile` in `visualization/WebServer.cpp` builds the file path by appending the raw URL path to the static root:

```cpp
std::string filePath =
"visualization/static" + (path == "/" ? "/index.html" : path);
```

There is no sanitization, so a request containing `..` segments escapes the static directory and can read arbitrary files the process can access. The exposure is reduced by the server being a local dashboard, but anything on the same host (or network, if the port is exposed) can read files through it.

## What to do

- Reject or normalize paths containing `..` (canonicalize with `std::filesystem::weakly_canonical` and verify the result is still under the static root).
- Return 403 or 404 for anything that resolves outside the root.
- Add unit tests covering `..` traversal, encoded traversal, and a normal file request.

## Notes

Related to the static root also being cwd-relative (tracked separately).

Start in visualization/WebServer.cpp at RestAPIServer::handleStaticFile and trace how the raw URL path becomes a file path under the static root. Add tests for .. traversal, encoded traversal, and a normal file request; done means outside-root requests return 403 or 404 while normal files still serve correctly.

Written by the indexing model from the issue text.