Escape-Proof Join

Implement safe_join(base: str, user_path: str) that joins base with user_path and raises ValueError if the resolved result escapes base (classic directory-traversal defense). Return the joined Path on success.

Difficulty: intermediate