Backport: fix(devtools): validate viewer database paths

[github-actions]

This is an automated backport of #16049 to the release-v6.0 branch. FYI @aayush-kapoor
This backport has conflicts that need to be resolved manually.

git cherry-pick output

Auto-merging packages/devtools/src/db.ts
CONFLICT (content): Merge conflict in packages/devtools/src/db.ts
Auto-merging packages/devtools/src/viewer/server.ts
CONFLICT (content): Merge conflict in packages/devtools/src/viewer/server.ts
error: could not apply 275674e5ea... fix(devtools): validate viewer database paths (#16049)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

[gr2m]

Closing as not applicable to release-v6.0.

VULN-11550 is the network-supplied dbPath → fs.readFileSync sink, but that feature doesn't exist on this branch:

• v6's reloadDb() takes no argument and reads only the local server-configured .devtools/generations.json.
• It's called once — await reloadDb() in /api/notify — with no path, and server.ts has no dbPath reference at all (notify never reads body.dbPath).

So there's no arbitrary-file-read sink to fix here. Applying #16049 would only add an unused remoteDbPath parameter + an unused validateRemoteDbPath export (dead code for an absent vulnerability), plus a db.test.ts that can't run on v6 (no vitest dep/config) and would break type-check.

v6 already reads the DB from server config only, and #16042's Host/Origin hardening is merged here too. The fix on main (#16049) is the complete remediation for VULN-11550; it never existed on the release branches.