fix(security): allow serving static files from uploads directory

- Remove overly restrictive absolute path check in isPathSafe
- Strip leading slash from request path before validation
- Fixes broken favicon and watermark image previews in branding page
- Path traversal protection remains intact with ../ pattern checks

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/utils/fileSecurityUtils.js

@@ -37,7 +37,6 @@ function isPathSafe(filePath) {
   // Check for common path traversal patterns
   const dangerousPatterns = [
     /\.\.[\/\\]/,  // ../ or ..\
-    /^[\/\\]/,     // Absolute paths
     /^[A-Za-z]:/,  // Windows drive letters
     /[\x00-\x1f]/  // Control characters
   ];