create-directory: access deadlock when creating subdirectories under allowed roots due to strict path validation

[KagaJiankui]

Summary

The create-directory tool currently rejects attempts to create new subdirectories under an allowed root, reporting:

1. “Error: access denied - path outside allowed directories: d:\Electronics\chengguan-shixi\report\2025-07”
2. “CreateFile D:\Electronics\chengguan-shixi\report**: The filename, directory name, or volume label syntax is incorrect.” when using wildcards (* or **).

Steps to Reproduce

1. Start the server with arbitrary allowed directory ./foo (in full path qualifier).
2. Call create-directory with subdirectory path ./foo/bar
3. Observe “access denied” error.
4. Attempt to configure allowed directory with wildcards (foo\* or foo\**) and see invalid syntax error on Windows OS.

Expected Behavior

• Creating any new subdirectory under an allowed root should be permitted.
• Wildcards or recursive patterns should either be explicitly supported or produce a clear “unsupported” error message.

Actual Behavior

• The code demands the exact target path to match an entry in allowedDirs, causing a logical deadlock: new directories can never be pre-registered.
• Wildcards in allowedDirs are treated as illegal path syntax on Windows.

Root Cause

• validatePath(path) only allows operations when the requested path exactly matches an entry in fs.allowedDirs, not when it resides under a permitted root.
• No support for glob or recursive matching in allowed directory list.

Proposed Fix

• Change validation logic to allow any path that falls under an allowed root (using filepath.Rel + EvalSymlinks to prevent traversal attacks).
• Optionally add support for explicit wildcards in configuration while maintaining strict path normalization.