feat(drive): stop writing in {file,folder}.user_id

plan:

    ```
    What step 5 is actually doing

    Goal: stop writing to storage.files.user_id / storage.folders.user_id on new INSERTs. This is a prerequisite for step 6 (dropping the column entirely). The column has existed since the pre-D0 single-owner era; every read that used to key on it has already been migrated to drive-membership grants over the last N days.

    What has to change together for this to be safe:

    ┌──────────────┬─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┬───────────────────────────────────────────────────────────────────────────────────────────────────────┐
    │    Piece     │                                                          What changes                                                           │                                                  Why                                                  │
    ├──────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────┤
    │ Migration    │ Swap storage.files uniqueness indexes from (folder_id, name, user_id) to (drive_id, folder_id, name)                            │ Otherwise, two new rows with user_id = NULL would both be allowed (PG treats NULLs as distinct) —     │
    │ (a)          │                                                                                                                                 │ uniqueness silently breaks                                                                            │
    ├──────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────┤
    │ Migration    │ ALTER user_id DROP NOT NULL on both tables                                                                                      │ Otherwise, dropping the INSERT bind violates NOT NULL and every write 500s                            │
    │ (b)          │                                                                                                                                 │                                                                                                       │
    ├──────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────┤
    │ Migration    │ Drop dead user_id-leading indexes                                                                                               │ Cheap cleanup — nothing scans them anymore                                                            │
    │ (c)          │                                                                                                                                 │                                                                                                       │
    ├──────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────┤
    │ PL/pgSQL (d) │ Rewrite storage.copy_folder_tree without user_id in the INSERT column list                                                      │ Cross-drive copy runs entirely in SQL, needs the same treatment                                       │
    ├──────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────┤
    │ Rust (e)     │ ~12 INSERT column-list drops across folder_db_repository, file_blob_write_repository, drive_pg_repository, dedup_service,       │ Actual write path                                                                                     │
    │              │ folder_service, load-seed.rs                                                                                                    │                                                                                                       │
    ├──────────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────┤
    │ Rust (f)     │ Simplify folder_db_repository::create_folder's parent lookup to only fetch drive_id (was fetching (user_id, drive_id))          │ It's fetching a value it no longer needs                                                              │
    └──────────────┴─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┴───────────────────────────────────────────────────────────────────────────────────────────────────────┘
    ```

src/application/dtos/favorites_dto.rs

@@ -124,7 +124,10 @@ pub struct FavoriteResourceRow {
     pub size: i64,
     pub resource_created_at: DateTime<Utc>,
     pub modified_at: DateTime<Utc>,
-    pub owner_id: Uuid,
+    /// Post-D7: nullable on new rows (the legacy `storage.{files,folders}.user_id`
+    /// column is no longer written). `is_owner` is now `false` when
+    /// this is `None` — see the SQL projection in favorites repo.
+    pub owner_id: Option<Uuid>,
     /// Drive that owns this row. Surfaced on the favorites listing
     /// so a UI can tell when a favorited item lives in a different
     /// drive than the user's home (post-D6 cross-drive moves +

src/application/dtos/folder_dto.rs

@@ -205,7 +205,11 @@ pub struct FolderResourceRow {
     pub size: i64,
     pub created_at: DateTime<Utc>,
     pub modified_at: DateTime<Utc>,
-    pub owner_id: Uuid,
+    /// Post-D7: the legacy `user_id` column on `storage.{files,folders}`
+    /// is nullable — new rows leave it NULL — so this optional. UI
+    /// surfaces should prefer `created_by` / `updated_by` on the
+    /// per-resource DTO instead.
+    pub owner_id: Option<Uuid>,
     /// Drive that owns this row. Same column as
     /// `storage.folders.drive_id` / `storage.files.drive_id`. Surfaced
     /// on the listing so a UI can tell when a child lives in a

src/application/dtos/recent_dto.rs

@@ -104,7 +104,10 @@ pub struct RecentResourceRow {
     pub size: i64,
     pub resource_created_at: DateTime<Utc>,
     pub modified_at: DateTime<Utc>,
-    pub owner_id: Uuid,
+    /// Post-D7: nullable on new rows (the legacy
+    /// `storage.{files,folders}.user_id` column is no longer written).
+    /// Consumers should prefer §14 provenance columns.
+    pub owner_id: Option<Uuid>,
     /// Drive that owns this row. Surfaced on the recent listing
     /// so a UI can tell when a recently-accessed item lives in a
     /// different drive than the user's home (post-D6 cross-drive

src/application/dtos/trash_dto.rs

@@ -60,7 +60,10 @@ pub struct TrashResourceRow {
     pub size: i64,
     pub resource_created_at: DateTime<Utc>,
     pub modified_at: DateTime<Utc>,
-    pub owner_id: Uuid,
+    /// Post-D7: nullable on new rows (the legacy `storage.{files,folders}.user_id`
+    /// column is no longer written). Consumers should prefer §14
+    /// provenance columns when available.
+    pub owner_id: Option<Uuid>,
     /// Drive the trashed item belongs to. Surfaced verbatim on the wire
     /// (`TrashResourceItemDto.drive_id`) so the `/trash` UI can group by
     /// drive without an extra lookup per row. D2b: filtering by drive is