fix: apply CodeRabbit feedback (security + lint)

Addresses 2 CodeRabbit review comments:

1. CRITICAL - Path traversal guard in files.py:
- Changed str(resolved).startswith(str(base)) to resolved.is_relative_to(base_dir)
- The startswith check could be bypassed with prefix collisions
- Example: /tmp/stroke-results-evil/file.txt would pass startswith
but correctly fails is_relative_to()

2. Minor - React lint error in CaseSelector.tsx:
- Moved setIsLoading(false) from .finally() into fetchCases callback
- Fixes react-hooks/set-state-in-effect lint rule violation
- setState should not be called synchronously within effect body

Tests: 69/69 frontend tests pass

frontend/src/components/CaseSelector.tsx

@@ -30,6 +30,7 @@ export function CaseSelector({
         setCases(data.cases);
         setIsWakingUp(false);
         setRetryCount(0);
+        setIsLoading(false);
         return; // Success
       } catch (err) {
         if (err instanceof Error && err.name === "AbortError") return;
@@ -63,6 +64,7 @@ export function CaseSelector({
               : "Unknown error";
         setError(`Failed to load cases: ${message}`);
         setIsWakingUp(false);
+        setIsLoading(false);
         return;
       }
     }
@@ -70,13 +72,7 @@ export function CaseSelector({
 
   useEffect(() => {
     const abortController = new AbortController();
-
-    fetchCases(abortController.signal).finally(() => {
-      if (!abortController.signal.aborted) {
-        setIsLoading(false);
-      }
-    });
-
+    fetchCases(abortController.signal);
     return () => abortController.abort();
   }, [fetchCases]);
 

src/stroke_deepisles_demo/api/files.py

@@ -48,9 +48,12 @@ async def get_result_file(job_id: str, case_id: str, filename: str) -> FileRespo
     file_path = RESULTS_DIR / job_id / case_id / filename
 
     # Security: Ensure path doesn't escape RESULTS_DIR (path traversal protection)
+    # Using is_relative_to() instead of startswith() to prevent prefix-collision bypass
+    # e.g., /tmp/stroke-results-evil/file.txt would pass startswith but fail is_relative_to
     try:
+        base_dir = RESULTS_DIR.resolve()
         resolved = file_path.resolve()
-        if not str(resolved).startswith(str(RESULTS_DIR.resolve())):
+        if not resolved.is_relative_to(base_dir):
             logger.warning("Path traversal attempt blocked: %s", filename)
             raise HTTPException(status_code=404, detail="File not found")
     except (OSError, ValueError):