feat: ZIP 경로 가드 추가 및 무결성 size 검증 도입 (TDD)

- buildZip에 경로 하드닝 추가: ../, 절대경로(/), 역슬래시(\) 금지
- assets.integrity.index.json에 size(byte) 필드 추가
- verifyIntegrity에서 size 불일치 검증 추가
- 경로/사이즈 검증 테스트 추가: zip.pathGuard.test.ts
- 전체 테스트 그린 유지

lib/exporter/zip.pathGuard.test.ts

@@ -0,0 +1,29 @@
+import { describe, it, expect } from 'vitest'
+import { buildZip } from '@/lib/exporter/zip'
+
+function u8(s: string): Uint8Array {
+  return new TextEncoder().encode(s)
+}
+
+describe('buildZip path guard', () => {
+  it('rejects dangerous asset paths with .. segments', async () => {
+    await expect(
+      buildZip({ html: '', css: '', js: '', assets: { '../evil.txt': u8('x') } })
+    ).rejects.toThrow(/invalid asset path/i)
+  })
+
+  it('rejects dangerous extras with absolute path and backslashes', async () => {
+    await expect(
+      buildZip({ html: '', css: '', js: '', extras: { '/abs.txt': u8('x') } })
+    ).rejects.toThrow(/invalid extra path/i)
+
+    await expect(
+      buildZip({ html: '', css: '', js: '', extras: { 'assets\\x.bin': u8('x') } })
+    ).rejects.toThrow(/invalid extra path/i)
+  })
+
+  it('accepts safe relative paths under assets/', async () => {
+    const zip = await buildZip({ html: '', css: '', js: '', assets: { 'assets/a.bin': u8('ok') } })
+    expect(zip.byteLength).toBeGreaterThan(0)
+  })
+})