fix: address Qodo code review findings

- Add missing snapshot-differ.test.ts to npm test script
- Fix path traversal vulnerability in agent-mail.ts with message ID validation
- Fix readLastTouchedVersion to log errors instead of silently swallowing them
- Sanitize log statements to not leak full paths
- Add projectRoot validation to all API routes
- Fix activity persistence write race conditions with promise chaining

Co-authored-by: openhands <openhands@all-hands.dev>

src/app/api/events/route.ts

@@ -17,6 +17,8 @@ async function readLastTouchedVersion(filePath: string): Promise<number | null>
     if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
       return null;
     }
+    // Log non-ENOENT errors but don't swallow them silently
+    console.error('[Events] Failed to read last-touched version:', error);
     return null;
   }
 }