SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files

Summary kernel/mcp/tools/file.go's resolvePath includes an explicit comment stating its sensitive-path blocklist is meant to align with the HTTP file API's established blacklist refuseToAccess in kernel/api/file.go, following the remediation for GHSA-cvhv-7xhj-xjp8 "Unauthenticated Administrator...