xftp: prevent sender from writing files outside the destination folder

[spaced4ndy]

No description provided.

[simplex-chat-agent]

Correct, minimal path-traversal fix for XFTP file reception.

A malicious sender controls the received file name via the file description; the CLI recv command used it verbatim to name the output (getFilePath → uniqueCombine), so a name like ../../escaped.txt could write outside the destination folder.

The fix sanitizes at the single choke point where names become paths:
safeFileNameStr = notDots . makeValid . takeFileName. takeFileName drops every directory component (using the recipient's platform separators), makeValid maps "" → "_", and notDots maps ./.. → "_". Those three ("", ., ..) are exactly the traversal-relevant residues left after takeFileName, so the combined path can no longer escape filePath.

Placing the sanitization inside uniqueCombine rather than at the parse boundary is a reasonable choice: it makes every name→path construction safe by construction, and the other callers all pass trusted bare names (show chunkNo, "redirect.yaml", timestamps), so their behavior is unchanged. The only caller that bypasses uniqueCombine (getFilePath's pure path) uses the recipient's own explicitly chosen path, not sender input.

Tests cover empty, ., .., ..., relative and absolute traversal, trailing slash, and ordinary names, plus an end-to-end uniqueCombine "../../escaped.txt" assertion.

No correctness, concurrency, or security gaps found. Approving.