Validate Database Profile Paths and Clean Up Orphaned Files

[foxintheloop]

Problem

Two issues in apps/electron/src/main/settings.ts:

1. Path traversal: The profile feature allows custom database paths with no validation that paths stay within the app data directory. A crafted path could read/write arbitrary files.
2. Orphan cleanup: deleteDatabaseProfile() (line 278-304) deletes the profile record but NOT the actual .db file, causing orphaned database files to accumulate on disk.

Solution

1. Validate that all profile paths resolve within the app's user data directory (app.getPath('userData'))
2. Delete the actual database file when deleting a profile (with user confirmation)
3. Add a cleanup utility to find and remove orphaned .db files

Files

• apps/electron/src/main/settings.ts — add path validation and file cleanup