fix(security): Patch path injection and stack trace exposure (CodeQL #31, #27)

- Fix py/path-injection (Alert #31, High severity):
  - Add _validate_job_path() to resolve and canonicalize paths
  - Enforce job_path stays within safe_root via relative_to()
  - Update get_max_loops(), get_job_summary_df(), render_job_summary()
    to accept and validate safe_root parameter
  - Update app.py caller to pass safe_root to render_job_summary()
  - On validation failure: return empty data / show warning

- Fix py/stack-trace-exposure (Alert #27, Medium severity):
  - Remove str(e) from error response in get_live_fx_data()
  - Replace with generic message: 'Internal error while fetching live FX data'
  - Remove unused exception variable to prevent accidental leakage

Files:
  rdagent/app/rl/ui/rl_summary.py
  rdagent/app/rl/ui/app.py
  rdagent/components/coder/factor_coder/eurusd_macro.py

rdagent/components/coder/factor_coder/eurusd_macro.py

@@ -116,14 +116,14 @@ def get_live_fx_data() -> dict:
             "success": True
         }
         
-    except Exception as e:
+    except Exception:
         return {
             "eurusd_price": None,
             "dxy_price": None,
             "realized_volatility": None,
             "eurusd_24h_change": None,
             "success": False,
-            "error": str(e)
+            "error": "Internal error while fetching live FX data"
         }