fix(security): apply 4 vulnerability fixes from security audit

1. Share password bypass (HIGH): enforce password check in get_shared_link_by_token,
   verify_shared_link_password now returns ShareDto only on correct password.
2. WebDAV MOVE ownership (MEDIUM): add assert_owner on destination parent folder
   for file moves in both PathResolver and legacy branches.
3. Path traversal defense-in-depth (LOW): add reject_path_traversal() to WebDAV,
   CalDAV, and CardDAV handlers rejecting '..' segments at HTTP boundary.
4. Setup race condition (LOW): atomic INSERT ... ON CONFLICT DO NOTHING in
   try_claim_initialization prevents duplicate admin creation.

src/application/ports/share_ports.rs

@@ -52,12 +52,14 @@ pub trait ShareUseCase: Send + Sync + 'static {
         per_page: usize,
     ) -> Result<PaginatedResponseDto<ShareDto>, DomainError>;
 
-    /// Verify a password for a password-protected shared link
+    /// Verify a password for a password-protected shared link.
+    /// On success, returns the full share metadata (`ShareDto`).
+    /// On failure (wrong password), returns `AccessDenied`.
     async fn verify_shared_link_password(
         &self,
         token: &str,
         password: &str,
-    ) -> Result<bool, DomainError>;
+    ) -> Result<ShareDto, DomainError>;
 
     /// Register an access to a shared link
     async fn register_shared_link_access(&self, token: &str) -> Result<(), DomainError>;