Unauthenticated file write via unsanitized upload filename

Path traversal in BioinfoMCP allows remote attackers to write files outside the upload directory through the POST /upload endpoint. The upload() route in bioinfo_mcp_platform/app.py passes the multipart filename directly to os.path.join() and f.save(), so absolute paths or traversal sequences escape the intended uploads directory. No authentication or user interaction is required; successful requests can create or overwrite any file writable by the server account and feed that path into the conversion workflow.