fix(gopher): block symlink escapes

[rissrice2105-agent]

Summary

• resolve both the member public base and requested target with filepath.EvalSymlinks
• reject Gopher selectors whose resolved target escapes the member area
• add a regression test for a symlink pointing from public_html to a sibling secret file

Closes #84

Testing

• go test ./internal/gopher