refactor: enhance security and streamline file handling

This commit introduces several improvements to the security and file handling mechanisms across the application. Key changes include:

- Updated the Dockerfile to pin the GitHub CLI version for reproducible builds.
- Refactored the secure file system operations to ensure consistent path validation and type handling.
- Removed legacy path management functions and streamlined the allowed paths logic in the security module.
- Enhanced route handlers to validate path parameters against the ALLOWED_ROOT_DIRECTORY, improving security against unauthorized access.
- Updated the settings service to focus solely on the Anthropic API key, removing references to Google and OpenAI keys.

These changes aim to enhance security, maintainability, and clarity in the codebase.

Tests: All unit tests passing.

apps/server/Dockerfile

@@ -26,13 +26,13 @@ RUN npm run build --workspace=apps/server
 # Production stage
 FROM node:20-alpine
 
-# Install git, curl, and GitHub CLI
+# Install git, curl, and GitHub CLI (pinned version for reproducible builds)
 RUN apk add --no-cache git curl && \
-    GH_VERSION=$(curl -s https://api.github.com/repos/cli/cli/releases/latest | grep '"tag_name"' | cut -d '"' -f 4 | sed 's/v//') && \
+    GH_VERSION="2.63.2" && \
     curl -L "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_amd64.tar.gz" -o gh.tar.gz && \
     tar -xzf gh.tar.gz && \
-    mv gh_*_linux_amd64/bin/gh /usr/local/bin/gh && \
-    rm -rf gh.tar.gz gh_*_linux_amd64
+    mv "gh_${GH_VERSION}_linux_amd64/bin/gh" /usr/local/bin/gh && \
+    rm -rf gh.tar.gz "gh_${GH_VERSION}_linux_amd64"
 
 WORKDIR /app