fix(docker-server): reject null bytes in resolvePath

Defensively harden the path traversal guard by returning null
early when the URL contains a null byte, before normalization runs.

Made-with: Cursor

docker-server.mjs

@@ -21,6 +21,7 @@ const contentTypes = {
 };
 
 function resolvePath(urlPath) {
+  if (urlPath.includes('\0')) return null;
   const cleanPath = normalize(decodeURIComponent(urlPath).replace(/^\/+/, ''));
   const candidate = join(root, cleanPath);
   if (!candidate.startsWith(root)) return null;