Restrict /api/pr file paths to packages/cdn/**

Summary

POST /api/pr will create a GitHub PR for any path the caller sends. The only real control is whether that GitHub token can push yearn/cms.

What happens

packages/app/src/server/pr.ts takes path / changes[].path from the JSON body and writes blobs + a tree with those paths. There is no allowlist. A token with write access could therefore propose changes under .github/** or other non-CDN paths, not only vault/strategy JSON.

Unauthenticated requests fail before any GitHub ref is created (token required). Random public_repo users still cannot push yearn/cms. This is defense in depth for stolen or overly-broad collaborator tokens (see the OAuth token-in-URL issue).

Suggested fix

• Accept only paths under packages/cdn/.
• Reject .github/**, workflow files, and anything outside the metadata trees.
• After the OAuth session moves into a cookie, add CSRF protection (SameSite + a CSRF token) on this route.

Start in packages/app/src/server/pr.ts and trace how path and changes[].path from POST /api/pr are used to build GitHub blobs and trees. Restrict accepted paths to packages/cdn/**, reject .github and other paths, and verify requests outside the metadata trees fail; treat the later cookie-based CSRF protection as separate follow-up work.