feat: add NasFileManager service with security-hardened file operations

TypeScript port of PHP NasFileManager with symlink rejection,
path traversal protection, MIME validation via file-type, and
blocked extension checking.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

package.json

@@ -34,6 +34,7 @@
     "date-fns": "^4.1.0",
     "dotenv": "^17.3.1",
     "fastify": "^5.8.2",
+    "file-type": "^16.5.4",
     "framer-motion": "^12.38.0",
     "hi-base32": "^0.5.1",
     "jsonwebtoken": "^9.0.3",