Fix: Prevent arbitrary file overwrite in backup_parent_seed

This change mitigates an arbitrary file overwrite vulnerability in the
`backup_parent_seed` API endpoint. Previously, the endpoint did not
check if the destination file already existed, allowing attackers or
accidental misuse to overwrite critical files if the path validation
passed.

The fix introduces a check using `resolved_path.exists()` after path
validation. If the file exists, the request is rejected with a
409 Conflict error.

A reproduction test case confirmed the vulnerability and verified the
fix. Regression tests on the API passed successfully.

Co-authored-by: PR0M3TH3AN <[email protected]>

src/seedpass/api.py

@@ -781,7 +781,9 @@ def backup_parent_seed(
     if not path_str:
         raise HTTPException(status_code=400, detail="Missing path")
     path = Path(path_str)
-    _validate_encryption_path(request, path)
+    resolved_path = _validate_encryption_path(request, path)
+    if resolved_path.exists():
+        raise HTTPException(status_code=409, detail="File already exists")
     pm.encryption_manager.encrypt_and_save_file(pm.parent_seed.encode("utf-8"), path)
     return {"status": "saved", "path": str(path)}