Refactor: Secure uploads route with authentication and input validation

[mohdsubhan1756]

Summary

Replaced the wide-open public static file serving for /uploads with a protected, dedicated GET route to enforce access control and validate file requests.

Key Changes

• Access Control: Added the protect middleware to ensure only authenticated users can access uploaded files.
• Input Validation: Implemented a strict regex check (/^[a-zA-Z0-9._-]+$/) to ensure filenames contain only safe characters.
• Path Traversal Protection: Added a check using filePath.startsWith(uploadsDir) to prevent attackers from executing path traversal attacks (e.g., trying to read sensitive files via ../ sequences).
• Robustness: Added an explicit fs.existsSync check to return a proper 404 File not found error before attempting to send the file.

[KaranUnique]

@mohdsubhan1756

Since /uploads is no longer publicly accessible, please verify that existing frontend features (profile images, uploaded files, etc.) continue to work correctly with the authenticated route