* fix: prevent path traversal in document meta API (CWE-22) * address review: delete legacy document/app/api/meta route instead of patching
