Security: --root / path allow-listing to sandbox which files are queryable #58

Deal-breaker for any remote / on-prem / multi-tenant deployment. Today csv_query (and the CLI) can read any path the process user can — e.g. SELECT * FROM '/etc/passwd' works. Fine on your own laptop; unacceptable the moment csvql is exposed to an agent or another user.

Scope

• --root <dir> (repeatable or comma-list) confines all file access to that directory tree.
• Reject anything outside root, including path traversal (../, symlinks escaping root, absolute paths outside root).
• Applies to --mcp (csv_query, csv_schema, csv_list) and ideally the CLI when the flag is set.
• Clear error: "path outside allowed root".

Done when

• With --root /data, SELECT * FROM '/etc/passwd' and '/data/../secret' are rejected; '/data/sales.csv' works.
• A test covers traversal + symlink escape.

Prerequisite for the on-prem SSH/HTTP access models (#TBD). Pairs with running csvql as a restricted user in a read-only-mounted container.