fix: CORS startup crash + path traversal security

- CORS: change allow_credentials=True to False (wildcard origins + credentials is forbidden by Starlette, causes AssertionError on boot)
- Path traversal: already fixed with is_relative_to (was in diff from prior session)

Author: dmpantiu

web/app.py

@@ -73,7 +73,7 @@ def create_app() -> FastAPI:
     app.add_middleware(
         CORSMiddleware,
         allow_origins=["*"],
-        allow_credentials=True,
+        allow_credentials=False,
         allow_methods=["*"],
         allow_headers=["*"],
     )

web/routes/api.py

@@ -127,7 +127,7 @@ async def download_dataset(path: str = Query(..., description="Path to Zarr data
     data_dir = (PROJECT_ROOT / "data").resolve()
 
     # Security: only allow paths under PROJECT_ROOT/data
-    if not str(dataset_path).startswith(str(data_dir)):
+    if not dataset_path.is_relative_to(data_dir):
         raise HTTPException(status_code=403, detail="Access denied: path outside data directory")
 
     if not dataset_path.exists():