POST /folders/init missing path traversal validation on `chart` parameter

[HahaSula]

Problem

`POST /folders/init` validates the `folder` parameter against `..` but does not apply the same check to `chart`:

```js
if (!folder || folder.includes('..')) { ... } // ✅ folder has validation
if (!chart) { ... } // ❌ chart only checks existence
```

If a caller sends `{ "chart": "../../etc" }`, the server resolves `path.join(chartsDir, "../../etc")` and attempts to read files outside the charts directory.

Suggested fix

```js
if (!chart || chart.includes('..')) {
return res.status(400).json({ error: 'Invalid chart name' })
}
```

Context

Found while reviewing PR #25. Same class of issue as the `file` parameter in `/api/git/diff`.