fix(controller): harden path traversal check against encoded bypass attempts

[bpamiri]

Summary

• Add URL-decode normalization and null-byte stripping before path traversal validation in $generateIncludeTemplatePath()
• Prevents bypasses using %2e%2e (URL-encoded ..) or null byte injection in partial/template names
• Defense-in-depth improvement — the value is developer-controlled in practice, but this hardens the framework against edge cases

Test plan

• Existing path traversal tests pass (normal partials still work)
• New tests verify URL-encoded traversal, null bytes, and mixed encoding are rejected
• Run bash tools/test-local.sh security

🤖 Generated with Claude Code