Protect private bank configuration from drift reconciliation (Refs #152)

src/lib/server/backends/files.ts

@@ -1,3 +1,4 @@
+import { isPrivateConfigPath } from '../fleet/private-config.js';
 import * as fs from 'node:fs/promises';
 import { join, posix, relative, resolve, sep } from 'node:path';
 import { config } from '../config.js';
@@ -85,6 +86,13 @@ export async function nativeFileManifest(
 }
 
 export async function readFile(path: string): Promise<Buffer> {
+    for (const root of [config.serversRoot, config.t6ServersRoot]) {
+        const [, ...parts] = relative(resolve(root), resolve(path)).split(sep);
+        if (isPrivateConfigPath(parts.join('/')))
+            throw new Error(
+                'Private bank configuration is not available through shared file reads.'
+            );
+    }
     const target = remote(path);
     if (!target) return fs.readFile(path);
     const result = await nativeRequest<{