fix: patch path traversal in export_report and create_set_template (v1.28.0)

Both handlers accepted a user-supplied output_path without boundary
validation, allowing MCP clients to write files to arbitrary filesystem
locations. A new safe_output_path() helper canonicalizes the parent
directory and asserts the resolved path stays within the allowed base
directory before any fs::write() call.

Also fixes pre-existing unused-import/dead-code warnings that blocked
the -D warnings release build.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/models/config.rs

@@ -2,7 +2,6 @@ use anyhow::Result;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::fs;
-use std::io::{BufRead, BufReader};
 use std::path::{Path, PathBuf};
 
 /// Active MT5 account session info