Defeat path traversal

Implement static string SafeJoin(string baseDir, string userInput) that joins a user-supplied relative filename onto a base directory but REJECTS traversal: normalize the combined path (Path.GetFullPath) and throw UnauthorizedAccessException if the result does not start with the normalized base (allowing the base to end with a separator). "report.pdf" passes; "..\..\etc\passwd" and absolute paths fail.