fix(remote): forward nested service cache files to and from the server

Cache keys are now the path relative to the service cache dir without .json, so Cacher keys like session_web/<sha1> reach the remote session. The credential filter runs on every path segment, the suffix is appended rather than substituted, and both sides cap the map at 64 keys.

tests/core/test_sanitize.py

@@ -10,16 +10,37 @@ def test_safe_cache_key_rejects_backslash_traversal():
     # "..\\..\\secret" as one filename; written as "<key>.json" it escapes the
     # cache dir on Windows. PureWindowsPath handling must reject it everywhere.
     assert safe_cache_key("..\\..\\secret") is None
-    assert safe_cache_key("sub\\dir") is None
+    assert safe_cache_key("sub\\..\\secret") is None
 
 
-def test_safe_cache_key_rejects_forward_slash_and_dotdot():
+def test_safe_cache_key_rejects_dotdot_and_empty_segments():
     assert safe_cache_key("../secret") is None
-    assert safe_cache_key("a/b") is None
+    assert safe_cache_key("a/../b") is None
+    assert safe_cache_key("a/./b") is None
     assert safe_cache_key("..") is None
     assert safe_cache_key(".") is None
     assert safe_cache_key("") is None
+    assert safe_cache_key("a//b") is None
+
+
+def test_safe_cache_key_rejects_absolute_paths_and_drives():
+    assert safe_cache_key("/etc/passwd") is None
+    assert safe_cache_key("\\x") is None
+    assert safe_cache_key("C:/x") is None
+    assert safe_cache_key("C:x") is None
+    assert safe_cache_key("//server/share/x") is None
+    assert safe_cache_key("a/b:stream") is None
+    assert safe_cache_key("a\x00b") is None
 
 
 def test_safe_cache_key_accepts_plain_filename():
     assert safe_cache_key("valid-key_123") == "valid-key_123"
+
+
+def test_safe_cache_key_accepts_nested_key_and_normalises_separators():
+    # A Cacher key with a subdirectory, as NF uses ("session_web/<sha1>"), keeps its
+    # posix form; a backslash from a Windows peer names the same nested file.
+    assert safe_cache_key("session_web/abc") == "session_web/abc"
+    assert safe_cache_key("MSL/a/b") == "MSL/a/b"
+    assert safe_cache_key("session_web\\abc") == "session_web/abc"
+    assert safe_cache_key("/".join(["d"] * 9)) is None