feat(library): support LIBRARY_BROWSE_ROOT to restrict file path access

Introduce a LIBRARY_BROWSE_ROOT environment variable (defaulting to the
current directory) to restrict directories users can browse and select when
setting up library paths. Add a PathPolicyService on the backend to enforce
path containment checks securely, and update the frontend FolderPickerModal
to prevent navigating above the configured browse root.

Closes #567

packages/types/src/path.ts

@@ -3,6 +3,10 @@ export interface DirectoryEntry {
   path: string;
 }
 
+export interface PathConfig {
+  root: string;
+}
+
 export interface CreateFolderRequest {
   parentPath: string;
   name: string;