fix: harden media path handling against path injection (CodeQL py/path-injection)

Resolve media filenames through a shared _resolve_media_path() barrier that
confirms the resolved path sits directly under the resolved media dir, so
CodeQL can trace the sanitization the regex already guaranteed.

ha-relevant: no

backend/tests/test_media.py

@@ -79,6 +79,13 @@ async def test_get_rejects_bad_filename(client, media_dir):
     assert res.status_code == 404
 
 
+@pytest.mark.asyncio
+async def test_delete_rejects_bad_filename(client, auth_headers, media_dir):
+    headers = await auth_headers()
+    res = await client.delete("/api/v1/media/..%2f..%2fetc%2fpasswd", headers=headers)
+    assert res.status_code == 404
+
+
 @pytest.mark.asyncio
 async def test_delete_requires_auth_and_removes_file(client, auth_headers, media_dir):
     headers = await auth_headers()