fix: use streaming and add path validation

- Replace fs.readFileSync() with fs.createReadStream() to prevent memory exhaustion
- Export validatePath() from fs-utils.ts
- Use validatePath() to validate full path including project and version parameters
- Fix incomplete path traversal protection
- Add filename encoding in Content-Disposition header

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

lib/fs-utils.ts

@@ -6,7 +6,7 @@ import { RESOURCE_PATH } from './constants';
 /**
  * Validate that a path doesn't escape the base directory (prevents path traversal)
  */
-function validatePath(basePath: string, ...segments: string[]): string {
+export function validatePath(basePath: string, ...segments: string[]): string {
   const fullPath = path.resolve(basePath, ...segments);
   const normalizedBase = path.resolve(basePath);
   if (!fullPath.startsWith(normalizedBase)) {