Harden upload folder handling

[kriptoburak]

Summary

• Default UPLOAD_FOLDER to uploads when the environment variable is missing.
• Validate delete payloads before reading fileName.
• Reject delete paths that escape the upload folder.
• Add focused Flask API regression tests.

Validation

• python -m pytest tests/test_file_api.py
• python -m py_compile main.py tests/test_file_api.py
• git diff --check