File routes must canonicalize the path, reject traversal, and allowlist permitted files.
