fix(security): apply 4 vulnerability fixes from security audit

1. Share password bypass (HIGH): enforce password check in get_shared_link_by_token,
   verify_shared_link_password now returns ShareDto only on correct password.
2. WebDAV MOVE ownership (MEDIUM): add assert_owner on destination parent folder
   for file moves in both PathResolver and legacy branches.
3. Path traversal defense-in-depth (LOW): add reject_path_traversal() to WebDAV,
   CalDAV, and CardDAV handlers rejecting '..' segments at HTTP boundary.
4. Setup race condition (LOW): atomic INSERT ... ON CONFLICT DO NOTHING in
   try_claim_initialization prevents duplicate admin creation.

src/application/services/admin_settings_service.rs

@@ -378,6 +378,21 @@ impl AdminSettingsService {
             .await
     }
 
+    /// Atomically try to claim system initialization.
+    ///
+    /// Returns `Ok(true)` if this call was the one that marked the system as
+    /// initialized (the caller "won" the race), or `Ok(false)` if another
+    /// request already did it.  This eliminates the race-condition window
+    /// between `is_system_initialized()` and `mark_system_initialized()`.
+    pub async fn try_claim_initialization(
+        &self,
+        admin_user_id: &str,
+    ) -> Result<bool, DomainError> {
+        self.settings_repo
+            .try_claim_initialization(admin_user_id)
+            .await
+    }
+
     // ========================================================================
     // Registration Control
     // ========================================================================