fix: confine case paths to storage directory

[rogerchappel]

Summary

• reject normalized case names whose resolved directory is not an immediate child of the configured storage root
• prevent . and .. from targeting the store itself or its parent
• add a CLI regression proving new .. fails without writing an index outside the store, while normal case creation still works

Evidence

Before this change, slugify("..") remained .., and path.join(storageDir, "..") allowed clipcase new .. to write index.json in the storage directory parent.

Verification

• npm ci
• npm run release:check
• bash scripts/validate.sh
• git diff --check