Harden template rendering and improve cache behavior

[beobles]

Motivation

• Prevent path traversal and accidental template inclusion outside the configured templates directory and make cache invalidation smarter when templates change.
• Eliminate unsafe direct injection of template expressions into compiled PHP to reduce injection risk and centralize expression evaluation and escaping.
• Make file cache robust and safe for concurrent processes by adding TTL, atomic writes, safe (restricted) unserialize and predictable cache keys.
• Improve runtime isolation of compiled templates and make common filters safer/UTF-8-aware.

Description

• Normalize and validate template/cache directories and block templates outside templates_dir in resolveTemplatePath, and make the cache key sensitive to filemtime/filesize via generateCacheKey.
• Replace inlined expression compilation with engine-level evaluation methods evaluateExpression and isTruthy (dot-path lookup, ??, filters, truthiness), and adapt Compiler to emit calls to these evaluators instead of raw PHP.
• Add balanced tag support (lexer/parser recognize closing PascalCase tags), introduce ElseNode/EndNode and emit balanced PHP blocks for If/Foreach with validation of foreach variable names in the Compiler.
• Harden FileCacheAdapter to use SHA-256 keyed .cache files, store serialized entries with expires_at, perform atomic writes to a temp file with LOCK_EX and rename, use unserialize(..., ['allowed_classes'=>false]), and restrict clear() to .cache files.
• Isolate compiled rendering in Renderer::render by running compiled code in an anonymous function with local extracted data and catch Throwable while preserving output buffering.
• Improve default filters for UTF-8 correctness (uppercase/lowercase use mb_* when available) and make reverse behave sensibly for strings and arrays.

Testing

• php -l $(rg --files -g '*.php') was run and returned no syntax errors. (passed)
• Rendered the example with rm -rf cache && php examples/index.php > /tmp/rendered.html and verified expected output tokens JOÃO SILVA, #0: Maria, #2: Ana. (passed)
• Verified path hardening using a negative case that attempts to render ../index.php against examples/templates, which produced the expected "Template path is outside templates directory" error. (expected behavior)
• Exercised FileCacheAdapter TTL/clear behavior with a small program that created a temp cache, wrote/read entries with TTL, verified expiry and infinite TTL behavior, and confirmed cache-ok on success. (passed)

---

Codex Task