fix: prevent path traversal in development server rewrite script

[gr8man]

Description
Validates that requested paths in system/rewrite.php stay within DOCUMENT_ROOT using realpath(), preventing the built-in development server (php spark serve) from serving files outside the public directory via path traversal.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[michalsn]

Could you provide an HTTP-level reproduction showing a file outside the document root being served before this change, including the PHP version and OS? Returning false delegates handling to PHP built-in server, it does not directly serve the resolved path. I couldn't reproduce the issue on PHP 8.2 or 8.5.

This also blocks intentional public symlinks pointing outside the document root. Without a reproduction, I'm not convinced the additional restriction and compatibility impact are justified for the development server.