fix(security): VULN-01 admin escalation + VULN-02 path traversal hardening

VULN-01 - Admin privilege escalation:
- Harden register() to reject is_admin=true
- Add /api/setup endpoint with setup_token for initial admin creation
- Add SetupAdminDto and setup_token to AppState
- Remove dead code from auth handler

VULN-02 - Path traversal (CVSS ~8.6):
- Solution A+E: Harden StoragePath constructors (from_string, new, join)
  to strip '..' and '.' segments and reject slash injection
- Solution B: resolve_path() now returns Result<PathBuf>, calls
  validate_path() internally, and verifies resolved path stays under root
- Update StoragePort trait signature to return Result<PathBuf, DomainError>
- Remove dead code: FilePathResolutionPort, StorageVerificationPort,
  DirectoryManagementPort (declared but never implemented)
- Add 17 security tests covering traversal attack vectors

src/application/dtos/user_dto.rs

@@ -46,7 +46,16 @@ pub struct RegisterDto {
     pub username: String,
     pub email: String,
     pub password: String,
-    pub role: Option<String>,
+}
+
+/// DTO for the one-time initial admin setup endpoint (`/api/setup`).
+/// Requires the setup token printed to the server log on first boot.
+#[derive(Debug, Serialize, Deserialize, Clone)]
+pub struct SetupAdminDto {
+    pub username: String,
+    pub email: String,
+    pub password: String,
+    pub setup_token: String,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]