refactor(daemon): centralize username path-segment sanitizer

Extract the inline path-traversal check from PendingStore into a shared
storage::safe_user::join_user_segment helper. RecoveryStore (next) reuses it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

daemon/src/storage/pending.rs

@@ -24,15 +24,9 @@ impl PendingStore {
     }
 
     fn user_path(&self, user: &str) -> Result<PathBuf, PendingError> {
-        if user.is_empty()
-            || user.contains('/')
-            || user.contains('\0')
-            || user == "."
-            || user == ".."
-        {
-            return Err(PendingError::InvalidUser(user.to_string()));
-        }
-        Ok(self.dir.join(user))
+        super::safe_user::join_user_segment(&self.dir, user).map_err(|e| match e {
+            super::safe_user::SegmentError::Invalid(s) => PendingError::InvalidUser(s),
+        })
     }
 
     pub fn set(&self, user: &str, flag: &PendingFlag) -> Result<(), PendingError> {