feat: Crawler API, CLI-credential auth, and platform fixes

…traversal

The previous fix for path traversal (CWE-22) in FilenameSchema reduced any
filename to its bare basename via path.basename(), which is more aggressive
than necessary: it also strips legitimate relative subfolders developers
commonly use (e.g. filename: 'output/data.json'), even though those never
posed a traversal risk.

FilenameSchema now allows relative subfolder segments, and instead
explicitly rejects (with a clear ValidationError, not a silent rewrite):
  - '..' segments anywhere in the path
  - absolute paths (POSIX '/x', Windows 'C:\x', UNC '\\host\share')
Backslashes are always treated as separators (not just on Windows), so a
Windows-shaped traversal payload can't slip through on a POSIX host by
switching separator style.

getAbsAndEnsureDir (utils/files.ts) is the single chokepoint all three
write paths converge on (saveResults, SnapshotAPI.download, and
BaseResult.save() — the last of which accepts a raw path that never passes
through FilenameSchema at all), so it now enforces containment itself
rather than assuming callers already sanitized:
  1. Lexical containment: resolved candidate must stay under baseDir.
  2. Real-path containment: after mkdir, re-resolve via fs.realpath and
     re-check, so a subfolder that is (or contains) a symlink pointing
     outside baseDir can't be used to escape it — lexical resolution alone
     is blind to symlinks.
Containment is only enforced for *relative* inputs: an absolute path is a
deliberate choice by the calling code (same trust model as calling
fs.writeFile directly) — BaseResult.save() has always supported writing to
an arbitrary absolute destination, and that's preserved.

Tests: rewrote tests/files.test.ts's FilenameSchema suite for the new
allow-subfolders/reject-traversal behavior, added a dedicated
getAbsAndEnsureDir suite (nested subfolders, relative-traversal rejection,
explicit-absolute-path pass-through, symlink-escape rejection), extended
saveResults integration tests (nested subfolder write, symlink-escape
rejection) and added BaseResult.save() coverage for the schema-bypass path.

…min)

fs.symlink() typically requires Developer Mode or admin rights on Windows,
unrelated to whether the containment fix itself works there. Skip the two
symlink-escape tests via it.skipIf(isWindows) instead of letting them fail
on an environment limitation rather than an actual regression.

…subfolders

fix: allow safe relative subfolders in filename while still blocking traversal