fix(gateway): support Windows drive letters and backslashes in file path regex (fixes #35270)

[Morad37]

The extract_media() and extract_local_files() regex in gateway/platforms/base.py only anchor to POSIX roots (home dir ~/ or root /), so Windows paths like C:\Users... get missed entirely. Two patterns updated:

• MEDIA_TAG_CLEANUP_RE anchor expanded to accept [a-zA-Z]:[/]
• path_re anchor expanded same way, plus directory separator accepts backslash

Closes #35270

[alt-glitch]

Competing with #35161 (most comprehensive — covers all 4 regex locations including gateway/run.py), #35162, #30778, #34021, #28991, #24049 for the same root cause (#28989). This PR also adds significant security hardening (media delivery path validation, safe roots, denylist, recency trust) beyond the regex fix — consider whether the security scope belongs in a separate PR.

[teknium1]

Closing as a duplicate — the Windows MEDIA-path fix landed in #35388 (#35388), salvaged from #35161. We picked the implementation that patched all four regex sites (MEDIA_TAG_CLEANUP_RE + extract_local_files in base.py, both _TOOL_MEDIA_RE in run.py) against current main. Thanks for tackling the same bug — your approach was correct, it just overlapped.