fix(html): Windows 盘符路径解码去掉前导斜杠，修复 html 预览被 isWithin 拒绝

decodeHtmlUrl 对 'D:\' 盘符路径重拼为 '/D:/...'，node path.resolve() 在 Windows
上会变成 'D:\D:\...'（盘符重复），html 路由的 isWithin(cwd) 围栏因此拒绝所有盘
符路径——打开 html 报 "html path outside the session working directory"。

修复：首段匹配 /^[A-Za-z]:$/（盘符段）时改回无前导斜杠的 'D:/...' 形式，
requireAbsolute 可原样解析回盘符路径；POSIX 路径行为不变。

测试：html-route.spec 更新 Windows round-trip 断言，新增小写盘符用例与
resolve() 回归护栏（win32 平台守卫）。

src/html-route.ts

@@ -66,5 +66,14 @@ export function decodeHtmlUrl(pathname: string): HtmlDecodeResult {
   if (sessionId === undefined || sessionId === '' || pathSegments.length === 0 || pathSegments.some(segment => segment === '')) {
     return { ok: false, status: 400, message: 'sessionId and file path are required' }
   }
-  return { ok: true, ref: { sessionId, path: `/${pathSegments.join('/')}` } }
+  // A Windows drive segment ('D:') is the FIRST path segment of an encoded
+  // drive path. Rejoining it with a leading slash would yield '/D:/work/...'
+  // which node's path.resolve() mangles into 'D:\D:\work\...' on Windows —
+  // the html route's isWithin(cwd) fence would then reject every drive path.
+  // Keep the drive form slash-free so requireAbsolute() resolves it verbatim.
+  const first = pathSegments[0] ?? ''
+  const path = /^[A-Za-z]:$/.test(first)
+    ? pathSegments.join('/')
+    : `/${pathSegments.join('/')}`
+  return { ok: true, ref: { sessionId, path } }
 }