fix: security audit — patch vulnerabilities V-02 through V-16

- V-02: XSS via innerHTML in profile.js — wrap err.message in escapeHtml()
- V-03: IDOR upload to other users' folders — add folder ownership check
- V-04: IDOR create folders in other users' trees — add parent ownership check
- V-06: Content-Disposition header injection — RFC 5987 percent-encoding
- V-08: WebDAV MOVE/COPY destination without ownership — add assert_owner checks
- V-09: .gitignore missing cert/key patterns — add *.pem, *.key, *.p12, etc.
- V-11: Username accepts XSS payloads — restrict to [a-zA-Z0-9._-]
- V-12: Minimal email validation — reject forbidden chars, require domain dot
- V-13: admin_reset_password doesn't invalidate sessions — revoke all sessions
- V-14: Rate limiting bypassable via X-Forwarded-For — gate behind OXICLOUD_TRUST_PROXY_HEADERS
- V-15: Cookie Secure flag off by default — default to true (safe-by-default)
- V-16: LIKE wildcard injection in searches — add like_escape() helper across 9 sites

src/interfaces/api/handlers/webdav_handler.rs

@@ -1160,7 +1160,11 @@ async fn handle_move(
                         None
                     } else {
                         match folder_service.get_folder_by_path(dest_parent_path).await {
-                            Ok(parent) => Some(parent.id),
+                            Ok(parent) => {
+                                // SECURITY: verify destination parent belongs to caller (V-08)
+                                assert_owner(parent.owner_id.as_deref(), &user.id, dest_parent_path)?;
+                                Some(parent.id)
+                            }
                             Err(_) => None,
                         }
                     },
@@ -1246,7 +1250,11 @@ async fn handle_move(
                     None
                 } else {
                     match folder_service.get_folder_by_path(dest_parent_path).await {
-                        Ok(parent) => Some(parent.id),
+                        Ok(parent) => {
+                            // SECURITY: verify destination parent belongs to caller (V-08)
+                            assert_owner(parent.owner_id.as_deref(), &user.id, dest_parent_path)?;
+                            Some(parent.id)
+                        }
                         Err(_) => None,
                     }
                 },
@@ -1417,7 +1425,11 @@ async fn handle_copy(
                     None
                 } else {
                     match folder_service.get_folder_by_path(dest_parent_path).await {
-                        Ok(parent) => Some(parent.id),
+                        Ok(parent) => {
+                            // SECURITY: verify destination parent belongs to caller (V-08)
+                            assert_owner(parent.owner_id.as_deref(), &user.id, dest_parent_path)?;
+                            Some(parent.id)
+                        }
                         Err(_) => None,
                     }
                 };
@@ -1461,7 +1473,11 @@ async fn handle_copy(
                     None
                 } else {
                     match folder_service.get_folder_by_path(dest_parent_path).await {
-                        Ok(parent) => Some(parent.id),
+                        Ok(parent) => {
+                            // SECURITY: verify destination parent belongs to caller (V-08)
+                            assert_owner(parent.owner_id.as_deref(), &user.id, dest_parent_path)?;
+                            Some(parent.id)
+                        }
                         Err(_) => None,
                     }
                 };
@@ -1501,7 +1517,11 @@ async fn handle_copy(
                 None
             } else {
                 match folder_service.get_folder_by_path(dest_parent_path).await {
-                    Ok(parent) => Some(parent.id),
+                    Ok(parent) => {
+                        // SECURITY: verify destination parent belongs to caller (V-08)
+                        assert_owner(parent.owner_id.as_deref(), &user.id, dest_parent_path)?;
+                        Some(parent.id)
+                    }
                     Err(_) => None,
                 }
             };
@@ -1552,7 +1572,11 @@ async fn handle_copy(
                 None
             } else {
                 match folder_service.get_folder_by_path(dest_parent_path).await {
-                    Ok(parent) => Some(parent.id),
+                    Ok(parent) => {
+                        // SECURITY: verify destination parent belongs to caller (V-08)
+                        assert_owner(parent.owner_id.as_deref(), &user.id, dest_parent_path)?;
+                        Some(parent.id)
+                    }
                     Err(_) => None,
                 }
             };