chore: CrowdSec file editor and hub extract minor follow-ups (F1/F3/F5) #1528

What: three low/informational items from the #1525 QA audit.

• F1 (low): backend/internal/crowdsec/hub_sync.go (archive entry name check) also rejects legitimate names that begin with ... Safe direction, but could be tightened to reject only .. path components.
• F3 (low): the backup field in the file-write and import responses (crowdsec_files.go, crowdsec_handler.go) is an absolute server path, and the import extraction error embeds the archive entry name. Matches existing preset-apply behavior; consider returning a relative/opaque identifier.
• F5 (info/product decision): the CrowdSec credentials YAML files are write-protected but still listed and readable in the file editor. Decide whether they should be hidden from read/list as well.

Suggested approach: decide F5 first (product call), then adjust F1/F3 if desired.

Found while working on #1525. Severity: low.