fix(import): allowed import roots, hostile zip symlink removal, tests

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/feature-import/src/web/ImportPage.tsx

@@ -5,7 +5,7 @@ import "./import.css";
 type Kind = "packt-video" | "code-repo" | "pdf-deck" | "video-folder";
 interface Job { id: string; kind: string; status: "queued" | "running" | "done" | "failed"; progress: number; message: string | null; payload: any; result: any; error: string | null; createdAt: string }
 interface CourseInfo { id: string; title: string; modules: { id: string; title: string; lessons: { id: string; title: string }[] }[] }
-interface Info { transcribe: boolean; coursesDir: string; coursesDirServed: boolean }
+interface Info { importRoots: string[]; transcribe: boolean; coursesDir: string; coursesDirServed: boolean }
 
 const KINDS: { value: Kind; label: string; hint: string; placeholder: string }[] = [
   { value: "packt-video", label: "Packt video zip", hint: "A video package whose index.html lists the sections and clips.", placeholder: "/data/downloads/video_zip.zip" },
@@ -139,6 +139,7 @@ export default function ImportPage() {
         <label className="imp-field">Path on the server
           <input type="text" className="mono" value={path} onChange={(e) => setPath(e.target.value)} placeholder={spec.placeholder} required />
           <span className="imp-hint">{spec.hint}</span>
+          {info ? <span className="imp-hint">Allowed folders: {info.importRoots.map((r) => <code key={r}>{r} </code>)}(set <code>STC_IMPORT_ROOTS</code>; git URLs are exempt)</span> : null}
         </label>
         {!needsCourse ? (
           <label className="imp-field">Course title (optional)