Block traversal segments in standard page export paths

Developer-mode exports now reject `..` segments to prevent writing outside the app directory.