fix(filestore): reject cross-drive path escape on Windows

path.relative(allowedRoot, resolved) returns an absolute path (not a
'..'-prefixed one) when allowedRoot and resolved are on different
Windows drives, silently bypassing the traversal check. Add an
isAbsolute guard so cross-drive escapes are rejected.

Addresses PR #7 review comment (security-critical).