Reject path traversal in deploy log download handler (closes #177)

gosec flagged G703 (path traversal via taint analysis) on the log
download handler because the served path derives from a URL parameter.
Open the log file through an os.Root confined to the deploy log
directory instead of passing the path to http.ServeFile; Root.Open
rejects any path that escapes the root, so traversal attempts return
404. Serve the opened file with http.ServeContent. Adds GetLogDir on
the deploy service and unit tests covering a legitimate download and a
traversal-shaped app name.

Model: opus-4-8

internal/handlers/handlers_test.go

@@ -42,6 +42,7 @@ type testContext struct {
 	database   *database.Database
 	authSvc    *auth.Service
 	appSvc     *app.Service
+	deploySvc  *deploy.Service
 	middleware *middleware.Middleware
 }
 
@@ -186,6 +187,7 @@ func setupTestHandlers(t *testing.T) *testContext {
 		database:   dbInstance,
 		authSvc:    authSvc,
 		appSvc:     appSvc,
+		deploySvc:  deploySvc,
 		middleware: mw,
 	}
 }