fix: security audit — patch vulnerabilities V-02 through V-16

- V-02: XSS via innerHTML in profile.js — wrap err.message in escapeHtml()
- V-03: IDOR upload to other users' folders — add folder ownership check
- V-04: IDOR create folders in other users' trees — add parent ownership check
- V-06: Content-Disposition header injection — RFC 5987 percent-encoding
- V-08: WebDAV MOVE/COPY destination without ownership — add assert_owner checks
- V-09: .gitignore missing cert/key patterns — add *.pem, *.key, *.p12, etc.
- V-11: Username accepts XSS payloads — restrict to [a-zA-Z0-9._-]
- V-12: Minimal email validation — reject forbidden chars, require domain dot
- V-13: admin_reset_password doesn't invalidate sessions — revoke all sessions
- V-14: Rate limiting bypassable via X-Forwarded-For — gate behind OXICLOUD_TRUST_PROXY_HEADERS
- V-15: Cookie Secure flag off by default — default to true (safe-by-default)
- V-16: LIKE wildcard injection in searches — add like_escape() helper across 9 sites

src/interfaces/api/handlers/folder_handler.rs

@@ -67,6 +67,19 @@ impl FolderHandler {
             }
         }
 
+        // ── SECURITY: Verify parent folder ownership (IDOR V-04 fix) ──
+        if let Some(ref parent_id) = dto.parent_id {
+            use crate::application::ports::inbound::FolderUseCase;
+            if service.get_folder_owned(parent_id, &auth_user.id).await.is_err() {
+                tracing::warn!(
+                    "create_folder: user '{}' attempted to create folder in parent '{}' owned by another user",
+                    auth_user.username,
+                    parent_id,
+                );
+                return AppError::not_found(format!("Parent folder not found: {}", parent_id)).into_response();
+            }
+        }
+
         match service.create_folder(dto).await {
             Ok(folder) => (StatusCode::CREATED, Json(folder)).into_response(),
             Err(err) => AppError::from(err).into_response()