fix(docker): wire tests into CI, fix resolvePath separator, correct image namespace

- Add `node --test docker-server.test.mjs` step to ci-tests.yml so the
  path-traversal guard tests run in every CI pass instead of being silently skipped.
- Fix resolvePath containment check: `startsWith(root)` would allow sibling
  directories like `/app/dist-evil/`; now guards with `root + sep` or exact match.
- Update docker-compose.yaml default image from `abhigyanpatwari` namespace to
  `brainifii` to match what docker.yml publishes to GHCR.

.github/workflows/ci-tests.yml

@@ -41,6 +41,9 @@ jobs:
           --outputFile=web-test-results.json
         working-directory: gitnexus-web
 
+      - name: Run docker-server integration tests
+        run: node --test docker-server.test.mjs
+
       - name: Upload test reports
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

docker-compose.yaml

@@ -1,6 +1,6 @@
 services:
   gitnexus:
-    image: ${IMAGE_NAME:-ghcr.io/abhigyanpatwari/gitnexus:latest}
+    image: ${IMAGE_NAME:-ghcr.io/brainifii/gitnexus:latest}
     container_name: ${CONTAINER_NAME:-gitnexus}
     ports:
       - '${HOST_PORT:-4173}:4173'

docker-server.mjs

@@ -1,7 +1,7 @@
 import { createReadStream } from 'node:fs';
 import { stat } from 'node:fs/promises';
 import { createServer } from 'node:http';
-import { extname, join, normalize } from 'node:path';
+import { extname, join, normalize, sep } from 'node:path';
 
 const host = '0.0.0.0';
 const port = Number(process.env.PORT || '4173');
@@ -30,7 +30,7 @@ function resolvePath(urlPath) {
   if (decoded.includes('\0')) return null;
   const cleanPath = normalize(decoded.replace(/^\/+/, ''));
   const candidate = join(root, cleanPath);
-  if (!candidate.startsWith(root)) return null;
+  if (candidate !== root && !candidate.startsWith(root + sep)) return null;
   return candidate;
 }