fix: use absolute paths in ls output for clickable file links (#52)

* Initial plan

* Fix: Use absolute paths in ls output for clickable links

When ls is run with a path argument (e.g., ls zenroom), files now show
with their full virtual paths (/zenroom/file.txt) instead of just the
basename (file.txt). This ensures that clicking on files works correctly
regardless of the current working directory.

Fixes issue where clicking on files after ls <path> resulted in
"cat: no such file or directory" errors.

Co-authored-by: puria <10379+puria@users.noreply.github.com>

* Remove test files from repository

Co-authored-by: puria <10379+puria@users.noreply.github.com>

* Add clarifying comments about path.Join usage

Added comments explaining why path.Join (not filepath.Join) is used for
virtual paths to ensure Unix-style forward slashes are always used,
regardless of the host OS.

Co-authored-by: puria <10379+puria@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: puria <10379+puria@users.noreply.github.com>

fix: prevent reflected/path XSS in index rendering (#50)

* fix: prevent reflected/path XSS in index rendering

Stop reflecting untrusted request paths into the app HTML; default invalid/out-of-root paths to  /  and only set
initial path when it’s an existing directory. Also escape terminal prompt and inline image HTML to avoid DOM/attribute
injection. Add regression tests for the reported payload.

Thanks to Keyur Maheta for the responsible disclosure.

* Update index.html

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update index.html

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix: Use stdlib URL and HTML escaping for defense in depth against attribute injection (#51)

* Initial plan

* Use stdlib url.PathEscape and html.EscapeString for defense in depth

Co-authored-by: puria <10379+puria@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: puria <10379+puria@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: puria <10379+puria@users.noreply.github.com>

fix: ooops

fix: honour sitempa disabled

fix: remove the stats command!

fix: integrate Docker build into release workflow

chore: fix lint errors

fix: tab completion cursor positioning and code formatting

Fix tab completion cursor bug where the cursor would jump to incorrect
position after autocompleting filenames or paths. The cursor now correctly
moves to the end of the completed text.

Changes:
- Fix cursor position after tab completion in index.html
  When tab completion updates the command line ($current), also update
  $cursorPos to match the new length. This prevents cursor quirks and
  incorrect positioning when typing after completion.

- Fix code formatting in main.go
  Correct indentation inconsistency in autocomplete handler (lines 2815-2816)
  from spaces to tabs to match project style.

Fixes reported issue where:
- Tab completion caused cursor to appear in wrong position
- Subsequent typing would insert characters at incorrect location

feat: docker images container publishing

feat: enhance docs + env vars