[Senate] Fix path traversal in bridge.py upload with Path.resolve()

[Senate] Fix path traversal in bridge.py upload with Path.resolve()

ID: f850da6d-e38 Priority: 87 Type: one_shot Status: open

Goal

Medium (M-1): bridge.py:32-36 upload endpoint vulnerable to path traversal. Replace os.path.join() with pathlib.Path.resolve() for safe path handling. Prevent writes outside BASE directory. See security_audit_2026-04-02.md.

Acceptance Criteria

Work Log