feat(mounts): external file mounts P1 — pluggable provider + read-only REST

Adds the foundation for external file mounts: admin-configured backends
(raw host filesystem in v1; sftp/webdav/… as future provider kinds) surfaced
as a folder inside a user's drive. Mount contents are virtual/live-passthrough
— read straight from the backend, never stored in storage.files — and are a
deliberately separate, limited storage type (no dedup/sharing/trash/search).
The feature is dark by default (OXICLOUD_ENABLE_EXTERNAL_MOUNTS=false).

P1 scope (this PR): data model, the pluggable provider abstraction, and the
read-only REST surface (mount listing + download). Read-write (P2),
WebDAV/NextCloud path resolution (P3), and the admin UI (P4) follow.

Core model
- Mount root = a real storage.folders row; authorization for everything inside
  collapses onto that folder UUID (ltree-ancestry grant cascade).
- Children are virtual, addressed by ext:<mount_id>:<base64url(node_id)> where
  node_id is provider-owned and opaque to the rest of the system.
- A lock-free (arc-swap) MountRegistry maps mount-root UUID -> provider; a thin
  MountRouter::classify() is the single cheap hook handlers call before parsing
  an id as a UUID. With no mounts configured it always returns Regular, so
  existing code paths are unchanged.

Added
- migrations/20260805000000_external_mounts.sql (storage.external_mounts, kind + config JSONB)
- domain/services/external_mount_id (id envelope + virtual etags)
- application/ports/external_mount_ports (ExternalMountProvider, MountProviderFactory, repo port)
- infrastructure local_fs_mount_provider (tokio::fs, symlink-escape-safe) + factory
- application MountRegistry + MountRouter, pg ExternalMountRepository
- DI wiring (AppState.mount_router), FeaturesConfig.enable_external_mounts
- listing branch (FolderService::list_mount_dir_with_perms + folder_handler) and
  download branch (FileRetrievalService stat/open mount methods + file_handler)

Authorization stays in the service layer (authz.require(Resource::Folder(mount_id)));
handlers only classify. Cross-backend operations are out of scope for P1.

Tests: 529 unit tests + 5 testcontainers integration tests (real Postgres 17),
including end-to-end authorization (owner allowed, stranger denied). Line
coverage of the new modules is 84–100% (cargo-llvm-cov). Known gap:
file_handler::download_mount_file (HTTP glue) needs a full-app test (P4).

src/application/services/file_retrieval_service.rs

@@ -5,10 +5,14 @@ use std::sync::Arc;
 
 use crate::application::dtos::file_dto::FileDto;
 use crate::application::ports::authorization_ports::AuthorizationEngine;
+use crate::application::ports::blob_storage_ports::BlobStream;
+use crate::application::ports::external_mount_ports::MountStat;
 use crate::application::ports::file_ports::{FileRetrievalUseCase, OptimizedFileContent};
 use crate::application::ports::storage_ports::FileReadPort;
+use crate::application::services::mount_registry::MountConfig;
 use crate::common::errors::DomainError;
 use crate::domain::services::authorization::{Permission, Resource, Subject};
+use crate::domain::services::external_mount_id::NodeId;
 use crate::infrastructure::repositories::pg::file_blob_read_repository::FileBlobReadRepository;
 use crate::infrastructure::services::file_content_cache::FileContentCache;
 use crate::infrastructure::services::image_transcode_service::{
@@ -64,6 +68,22 @@ impl FileRetrievalService {
         }
     }
 
+    /// Test-only constructor: authorization engine without the cache/transcode
+    /// tiers. The external-mount read methods only consult `authz` + the
+    /// provider, so this is sufficient to exercise their authorization.
+    #[cfg(all(test, integration_tests))]
+    pub(crate) fn new_with_authz_for_test(
+        file_read: Arc<FileBlobReadRepository>,
+        authz: Arc<PgAclEngine>,
+    ) -> Self {
+        Self {
+            file_read,
+            content_cache: None,
+            transcode: None,
+            authz: Some(authz),
+        }
+    }
+
     // ── private helpers ──────────────────────────────────────────
 
     /// Read a file's full content through the streaming API into a single
@@ -122,6 +142,50 @@ impl FileRetrievalService {
             .await
     }
 
+    /// Authorize then `stat` a file inside an external mount. Authorization
+    /// collapses onto the mount-root folder (a `Read` grant there covers
+    /// everything in the mount).
+    pub async fn stat_mount_file_with_perms(
+        &self,
+        cfg: &MountConfig,
+        node_id: &NodeId,
+        caller_id: Uuid,
+    ) -> Result<MountStat, DomainError> {
+        let authz = self.authz.as_ref().ok_or_else(|| {
+            DomainError::internal_error("FileRetrieval", "Authorization engine unavailable")
+        })?;
+        authz
+            .require(
+                Subject::User(caller_id),
+                Permission::Read,
+                Resource::Folder(cfg.mount_id),
+            )
+            .await?;
+        cfg.provider.stat(node_id).await
+    }
+
+    /// Authorize then open a (optionally ranged) read stream over a mount file.
+    /// `range` is `(start, end_inclusive_opt)`.
+    pub async fn open_mount_file_with_perms(
+        &self,
+        cfg: &MountConfig,
+        node_id: &NodeId,
+        caller_id: Uuid,
+        range: Option<(u64, Option<u64>)>,
+    ) -> Result<BlobStream, DomainError> {
+        let authz = self.authz.as_ref().ok_or_else(|| {
+            DomainError::internal_error("FileRetrieval", "Authorization engine unavailable")
+        })?;
+        authz
+            .require(
+                Subject::User(caller_id),
+                Permission::Read,
+                Resource::Folder(cfg.mount_id),
+            )
+            .await?;
+        cfg.provider.open_read_stream(node_id, range).await
+    }
+
     /// Try to transcode image content to WebP and return transcoded variant.
     async fn try_transcode(
         &self,