feat(studio): media references for imported courses (path, size, sha256, .gitignore)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/feature-studio/src/server/relpath.ts

@@ -0,0 +1,12 @@
+import { isAbsolute, normalize, sep } from "node:path";
+
+/** Normalised relative path, or throws. Rejects absolute paths, `..`, `.git` and NUL. */
+export function checkRelPath(p: string): string {
+  if (typeof p !== "string" || p === "" || p.includes("\0") || isAbsolute(p) || p.includes("\\")) throw new Error(`invalid path: ${JSON.stringify(p)}`);
+  const n = normalize(p);
+  const parts = n.split(sep);
+  if (n === "." || parts[0] === ".." || parts.some((x) => x === ".." || x.toLowerCase() === ".git") || n.endsWith(sep)) {
+    throw new Error(`invalid path: ${JSON.stringify(p)}`);
+  }
+  return n;
+}