refactor: integrate secure file system operations across services

This commit replaces direct file system operations with a secure file system adapter to enhance security by enforcing path validation. The changes include:

- Replaced `fs` imports with `secureFs` in various services and utilities.
- Updated file operations in `agent-service`, `auto-mode-service`, `feature-loader`, and `settings-service` to use the secure file system methods.
- Ensured that all file I/O operations are validated against the ALLOWED_ROOT_DIRECTORY.

This refactor aims to prevent unauthorized file access and improve overall security posture.

Tests: All unit tests passing.

🤖 Generated with Claude Code

apps/server/src/routes/suggestions/index.ts

@@ -4,6 +4,7 @@
 
 import { Router } from "express";
 import type { EventEmitter } from "../../lib/events.js";
+import { validatePathParams } from "../../middleware/validate-paths.js";
 import { createGenerateHandler } from "./routes/generate.js";
 import { createStopHandler } from "./routes/stop.js";
 import { createStatusHandler } from "./routes/status.js";
@@ -11,7 +12,7 @@ import { createStatusHandler } from "./routes/status.js";
 export function createSuggestionsRoutes(events: EventEmitter): Router {
   const router = Router();
 
-  router.post("/generate", createGenerateHandler(events));
+  router.post("/generate", validatePathParams("projectPath"), createGenerateHandler(events));
   router.post("/stop", createStopHandler());
   router.get("/status", createStatusHandler());
 

apps/server/src/routes/suggestions/routes/generate.ts

@@ -12,7 +12,6 @@ import {
   logError,
 } from "../common.js";
 import { generateSuggestions } from "../generate-suggestions.js";
-import { validatePath, PathNotAllowedError } from "../../../lib/security.js";
 
 const logger = createLogger("Suggestions");
 
@@ -29,20 +28,6 @@ export function createGenerateHandler(events: EventEmitter) {
         return;
       }
 
-      // Validate paths are within ALLOWED_ROOT_DIRECTORY
-      try {
-        validatePath(projectPath);
-      } catch (error) {
-        if (error instanceof PathNotAllowedError) {
-          res.status(403).json({
-            success: false,
-            error: error.message,
-          });
-          return;
-        }
-        throw error;
-      }
-
       const { isRunning } = getSuggestionsStatus();
       if (isRunning) {
         res.json({