feat(server): add safe directory creation to path service

Introduces PathService.createDirectory with comprehensive path validation
to prevent directory traversal and symlink attacks. It validates parent paths
against a blocked list, ensures the parent is a real directory, and blocks
unsafe characters in folder names.

Filesystem errors like EEXIST and EACCES are mapped to standard HTTP
exceptions to provide clear feedback to the client.

Closes #332

packages/types/src/index.ts

@@ -43,3 +43,4 @@ export * from "./achievement";
 export * from "./reading-session";
 export * from "./annotation";
 export * from "./hardcover";
+export * from "./path";

packages/types/src/path.ts

@@ -0,0 +1,11 @@
+export interface DirectoryEntry {
+  name: string;
+  path: string;
+}
+
+export interface CreateFolderRequest {
+  parentPath: string;
+  name: string;
+}
+
+export type CreateFolderResult = DirectoryEntry;