Sanitize uploaded filenames to prevent directory traversal attacks

[Copilot]

Addresses security vulnerability where user-provided filenames were used directly in file operations, allowing potential directory traversal attacks (e.g., ../../etc/passwd).

Changes

• Import secure_filename from werkzeug.utils
• Sanitize filenames before saving in /preview and /upload endpoints (image uploads)
• Sanitize filename parameter in /get_preview/<filename> endpoint

# Before
file.save(os.path.join(session_images_path, file.filename))

# After
safe_filename = secure_filename(file.filename)
file.save(os.path.join(session_images_path, safe_filename))

The secure_filename() function strips directory components and dangerous characters from user-provided filenames.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.