pub fn safe_path_join(base: &Path, relative: &Path) -> Result<PathBuf>
Join paths safely, preventing directory traversal