Source resolver that reads images from a configured root directory.
Maps %Image.Plug.Source{kind: :path, ref: "/foo/bar.jpg"} onto
<root>/foo/bar.jpg. Only :path sources are accepted.
Decoding is streaming-friendly: the file path is passed straight to
Image.open/2, which lets libvips mmap or progressively decode
rather than slurping the file into a binary first.
Configuration
:root(required) — absolute path to the directory under which source files live. Must exist at boot time. Symlinks pointing outside the root are rejected at request time.
Security
Path-traversal is blocked at two levels: Image.Plug.Source.path/1
rejects .. segments before the source even reaches the resolver,
and the resolver re-validates that the canonical resolved path is
still inside the root.