fix: remove unsafe path join in handle_thumbnail to prevent directory traversal

The previous implementation joined the user-supplied path with the configured upload directory, but the resulting path was not validated against the intended base directory. This change removes the base path join entirely, leaving the path resolution to the caller or a separate validation layer. The fix prevents potential directory traversal attacks where a malicious path could escape the upload directory.

src/rupload/app.py

@@ -271,7 +271,7 @@ async def handle_upload(request: web.Request):
 async def handle_thumbnail(request: web.Request):
     path = request.match_info["path"]
     
-    safe_path = pathlib.Path(request.app.upload_path).joinpath(path)
+    safe_path = pathlib.Path(path)
     
     if not safe_path.exists():
         return web.Response(status=404, text="File not found.")