feat: add file persistence and autosave backend system

[woydarko]

Summary

Closes #57

Adds the backend file persistence system for the autosave feature — five REST endpoints that allow the frontend to save, load, list, delete, and create files inside the session workspace (instance_dir), following the same pattern used by the existing Soroban routes.

What was added

server/routes/file_routes.py (new)

POST /api/files/save

• Creates or overwrites a file in the session workspace
• Validates session ownership, path traversal protection, blocked extensions (.exe, .bin, .so, .dll, .dylib)
• Creates parent directories automatically (mkdir -p)
• Max file size: 5MB
• Returns {success, path, size, created}

GET /api/files/load

• Loads file contents from session workspace
• Path traversal protection, file size check
• Returns {success, path, content, size}

GET /api/files/list

• Lists all files recursively in session workspace
• Skips hidden files (.env, .git) and __pycache__
• Optional subdir filter
• Returns {success, files: [{path, size, is_dir}], total}

DELETE /api/files/delete

• Deletes a single file; path traversal protection

POST /api/files/mkdir

• Creates a directory (idempotent); path traversal protection

All endpoints validate session ownership via session_id + user_id.

server/start.py

Registered files_bp blueprint

server/tests/test_file_routes.py (new)

37 tests covering all endpoints:

• _safe_path: valid path, parent traversal blocked, absolute path
• _validate_filename: null byte, absolute, hidden root, valid cases
• All 5 endpoints: missing fields, session not found, traversal blocked, success cases

Results

Tests: 148 passed, 0 failed (37 new + all existing)

[Atharv777]

Issue already resolved, hence closing the PR