[Code scan] Replace shell-based dataset split copies with shutil calls

This issue is part of a Codex global repository scan.

Problem:
`dptb data --split` copies user-controlled dataset paths through `os.system(f"cp -r ...")` without quoting.

Code reference:
https://github.com/deepmodeling/deeptb/blob/86c60c73996f0dd961c3138f2e88424382cb734e/dptb/entrypoints/data.py#L86-L98

Impact:
Dataset paths containing spaces fail. Paths containing shell metacharacters can execute unintended commands. The file already imports `shutil`, so this can use structured Python copy APIs instead of a shell.

Suggested fix:
Use `shutil.copytree()` or `shutil.copy2()` depending on whether each matched input is a directory or file, and avoid invoking a shell.

Start in dptb/entrypoints/data.py around lines 86-98, where the dptb data --split command copies matched dataset paths. Exercise the command with paths containing spaces and shell metacharacters, and verify that directory and file inputs are copied without shell execution. Done means the split copies work safely for both input types.

Written by the indexing model from the issue text.