fix(security): resolve open CodeQL path-injection and temp-file alerts (#1322)

Re-establish the path-containment barrier inline at the backup readdir
sink in restoreStackFiles. The sink previously built backupDir through
the getBackupDir helper, whose stack-name validation the static analyzer
does not trace, leaving a flagged path-injection sink. The barrier now
resolves backupDir against its root and asserts containment inline, the
same pattern already used in backupStackFiles. Behavior is unchanged for
valid stack names (already validated one line above by resolveStackDir).

Scope the js/insecure-temporary-file rule out of e2e/** in the CodeQL
config. End-to-end fixtures must seed files into the backend's COMPOSE_DIR
so the API under test can read them back; that path is a fixed location
under /tmp in both CI and local dev, which the rule flags. A randomized
temp directory does not apply because the backend resolves against its own
COMPOSE_DIR. Production code is still analyzed.

.github/codeql/codeql-config.yml

@@ -13,3 +13,16 @@ query-filters:
         - backend/src/utils/apiTokenFormat.ts
         - backend/src/routes/apiTokens.ts
         - backend/src/__tests__/**
+  # End-to-end fixtures seed files directly into the backend's COMPOSE_DIR so
+  # the API under test can read them back. Both the test runner and the backend
+  # use a fixed path under /tmp (the spec fallback and the CI start-app default
+  # are both /tmp/compose), so CodeQL flags the hardcoded literal as
+  # js/insecure-temporary-file. A randomized mkdtemp does not apply here: the
+  # backend resolves paths against its own COMPOSE_DIR, so a fixture written
+  # elsewhere would be invisible to it. The predictable-temp-path threat is also
+  # moot on the ephemeral, single-tenant machines these specs run on.
+  # Scoped to e2e/** so production code is still analyzed.
+  - exclude:
+      id: js/insecure-temporary-file
+      paths:
+        - e2e/**

backend/src/services/FileSystemService.ts

@@ -816,7 +816,17 @@ export class FileSystemService {
     const debug = isDebugEnabled();
     const t0 = Date.now();
     const stackDir = this.resolveStackDir(stackName);
-    const backupDir = this.getBackupDir(stackName);
+    // Canonical js/path-injection barrier at the backup read sink: resolve the
+    // backup dir against its root and confirm containment inline, mirroring
+    // backupStackFiles. stackName is already validated by resolveStackDir above;
+    // re-establishing containment at the readdir sink itself lets static
+    // analysis see the barrier, which it does not credit through the
+    // getBackupDir helper.
+    const backupRoot = path.resolve(getBackupBaseDir());
+    const backupDir = path.resolve(backupRoot, String(this.nodeId), stackName);
+    if (!backupDir.startsWith(backupRoot + path.sep)) {
+      throw Object.assign(new Error('Path escapes backup directory'), { code: 'INVALID_PATH' });
+    }
 
     const items = await fsPromises.readdir(backupDir);
     const backedUp = new Set(items);