[Security][Info] Template workDir not validated at creation time

[OneStepAt4time]

Summary

server.ts:1637-1685 — When creating a template (POST /v1/templates), the workDir field is not validated against validateWorkDir. A template could store a path-traversal payload that would only be caught later when the template is instantiated.

Files Affected

• src/server.ts:1637-1685

Suggested Fix

Validate workDir at template creation time using validateWorkDirWithConfig, or document that validation happens at instantiation.

---

Code review finding from full codebase audit (2026-04-04)

[OneStepAt4time]

Closing per decisione Ema.