fix(server): canonicalise media paths the same way their callers do#9575

Note

Medium Risk Touches security-sensitive media open acceptance logic; behavior can differ only where the two Node realpath APIs disagree (notably Windows short paths).

Overview openMediaFile no longer uses fs/promises.realpath for its “path must already be canonical” guard. It now calls callback fs.realpath via realpathLikeFileSystem, matching how upstream code canonicalises with Effect FileSystem.realPath. That fixes false rejections on Windows when the promises API expands 8.3 short names while the caller’s path is already canonical; symlink-swap protection is unchanged in intent.

AssetAccess and ProjectFaviconResolver tests now assert sourcePath / resolved favicon paths with Path.join instead of hard-coded / segments, so expectations match platform-native separators.

^{Reviewed by Cursor Bugbot for commit 2c64068e10a194c8d8732a046147b9f240a4104a. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Use callback-based Node realpath in openMediaFile descriptor checks

• Adds realpathLikeFileSystem, a Promise wrapper around the callback-based Node fs.realpath, and replaces the fs/promises.realpath call in openMediaFile's acceptance checks with it.
• This aligns the canonicalization with how callers produce paths, fixing mismatches where the two Node realpath APIs return different representations (e.g. Windows 8.3 short names).
• Updates AssetAccess and ProjectFaviconResolver tests to assert exact platform-native joined paths instead of slash-separated substring checks.
• Behavioral Change: openMediaFile may now accept or reject files differently for paths whose fs/promises.realpath and callback-based fs.realpath disagree; reviewers should check the descriptor acceptance logic in MediaFile.ts.

^{Macroscope summarized 2c64068.}