Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.

apps/api/internal/catalog/files_path_test.go

@@ -0,0 +1,46 @@
+package catalog
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/google/uuid"
+)
+
+func TestResolveUploadPath(t *testing.T) {
+	t.Parallel()
+	base := t.TempDir()
+	cid := uuid.New()
+	rel := cid.String() + "/sample.csv"
+	absWant := filepath.Join(base, filepath.FromSlash(rel))
+	if err := os.MkdirAll(filepath.Dir(absWant), 0o750); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(absWant, []byte("a,b\n1,2\n"), 0o640); err != nil {
+		t.Fatal(err)
+	}
+
+	svc := &Service{}
+	got, err := svc.ResolveUploadPath(base, cid, rel)
+	if err != nil {
+		t.Fatalf("resolve: %v", err)
+	}
+	if filepath.Clean(got) != filepath.Clean(absWant) {
+		t.Fatalf("got %q want %q", got, absWant)
+	}
+
+	if _, err := svc.ResolveUploadPath("", cid, rel); err == nil {
+		t.Fatal("expected empty upload dir reject")
+	}
+	if _, err := svc.ResolveUploadPath(base, cid, "../etc/passwd"); err == nil {
+		t.Fatal("expected traversal reject")
+	}
+	if _, err := svc.ResolveUploadPath(base, cid, cid.String()+"/../outside.csv"); err == nil {
+		t.Fatal("expected nested traversal reject")
+	}
+	other := uuid.New()
+	if _, err := svc.ResolveUploadPath(base, cid, other.String()+"/x.csv"); err == nil {
+		t.Fatal("expected company mismatch reject")
+	}
+}