fix(housekeeping): close final authorization gaps

src/features/housekeeping/domains/content/services/mutation-runtime-external.test.ts

@@ -147,6 +147,19 @@ describe("Content external mutation runtime", () => {
 		expect(fsMocks.unlink).not.toHaveBeenCalled();
 	});
 
+	it.each(["favicon/brand.ico", "logo/brand.png", "favicon\\brand.ico"])(
+		"rejects nested media deletion outside the generic upload namespace: %s",
+		async (filename) => {
+			await expect(
+				executeContentExternalMutation("media.delete", { filename }, context),
+			).rejects.toMatchObject({
+				code: "VALIDATION",
+				messageKey: "errors.housekeeping.validation",
+			} satisfies Partial<ContentMutationFailure>);
+			expect(fsMocks.unlink).not.toHaveBeenCalled();
+		},
+	);
+
 	it("rejects declared MIME, filename extension, and actual bytes that disagree", async () => {
 		const disguisedSvg = new File(
 			['<svg xmlns="http://www.w3.org/2000/svg"></svg>'],

src/features/housekeeping/domains/content/services/mutation-runtime-external.ts

@@ -247,6 +247,7 @@ async function mediaUpload(input: unknown): Promise<ContentMutationSnapshot> {
 
 async function mediaDelete(input: unknown): Promise<ContentMutationSnapshot> {
 	const name = text(record(input).filename ?? record(input).name, 255, true);
+	if (name.includes("/") || name.includes("\\")) throw validation();
 	let filePath: string;
 	try {
 		filePath = resolveMediaPath(name);