fix(security): resolve path-injection, B701, B101, B112 Bandit alerts

- Path injection (B614): centralized safe_resolve_path in core/utils.py,
  refactored 6 UI modules to use it with safe_root validation
- B701: added explicit autoescape=select_autoescape() to Jinja2
  Environment() calls in 3 files
- B101: replaced assert statements with proper if/raise patterns in
  12+ files (partial)
- B112: added logger.warning() to bare except:continue blocks in
  5 files

rdagent/app/qlib_rd_loop/quant.py

@@ -322,6 +322,7 @@ class QuantRDLoop(RDLoop):
                     if data.get("status") == "success" and data.get("ic") is not None:
                         factors.append(data)
                 except Exception:
+                    logger.warning("Failed to load factor file %s", f, exc_info=True)
                     continue
 
             if len(factors) < 10: