fix: mitigate unauthenticated path traversal in genmedia SPA routing

[AK47Kavan]

Fixes #2201

Description

This PR resolves the unauthenticated path traversal vulnerability reported in issue #2201 within the genmedia-for-commerce application routing.

Changes

• Replaced direct unsafe path concatenation with absolute path resolution via pathlib.Path.resolve().
• Implemented a strict safe_path.is_relative_to(resolved_frontend_dir) check to ensure that the resolved asset path cannot traverse outside the boundary of the designated frontend assets directory.
• Preserved the original SPA behavior and fallback rules while explicitly returning a 403 Forbidden JSON response if a path traversal attempt is detected.

Verification

• Confirmed that directory climbing patterns (e.g., ../../) are safely caught and rejected by the validation step.
• Ensured local formatting remains compliant with the repository's rules.