Gates /api/doc reads on realpath containment: a path must resolve inside the project both as written and after symlink resolution, else 403. Consolidates the duplicated doc-read logic from both server runtimes into one shared module (packages/shared/doc-resolve.ts, vendored to Pi).
Claude-Session: https://claude.ai/code/session_019GV6EKtzh8Pf9GA2rrBLNf
Ben Drucker