fix(security): patch 3 vulnerabilities — IDOR, ownership bypass, XSS

V1: Add owner-scoped folder pagination (list_folders_by_owner_paginated)
  - New method in FolderRepository trait, PG implementation, service & handler
  - Prevents IDOR by filtering folder listings to authenticated user

V2: Enforce ownership checks on folder mutations
  - rename_folder, move_folder, delete_folder now require caller_id
  - Service verifies folder.owner_id == caller_id (returns 404 on mismatch)
  - Propagated to folder_handler, batch_handler, batch_operations, webdav_handler
  - delete_folder_with_trash upgraded from OptionalAuthUser to AuthUser
  - download_folder_zip now checks ownership before streaming

V3: Fix XSS in frontend via DOM APIs
  - sharedView.js: innerHTML → createElement + textContent
  - contextMenus.js: innerHTML → DOM construction for share dialog

Cleanup: removed unused OptionalAuthUser import, updated all stubs/mocks

src/application/ports/inbound.rs

@@ -38,15 +38,23 @@ pub trait FolderUseCase: Send + Sync + 'static {
         pagination: &crate::application::dtos::pagination::PaginationRequestDto,
     ) -> Result<crate::application::dtos::pagination::PaginatedResponseDto<FolderDto>, DomainError>;
 
-    /// Renames a folder
-    async fn rename_folder(&self, id: &str, dto: RenameFolderDto)
+    /// Lists folders with pagination, scoped to a specific owner.
+    async fn list_folders_for_owner_paginated(
+        &self,
+        parent_id: Option<&str>,
+        owner_id: &str,
+        pagination: &crate::application::dtos::pagination::PaginationRequestDto,
+    ) -> Result<crate::application::dtos::pagination::PaginatedResponseDto<FolderDto>, DomainError>;
+
+    /// Renames a folder (ownership verified against caller_id)
+    async fn rename_folder(&self, id: &str, dto: RenameFolderDto, caller_id: &str)
     -> Result<FolderDto, DomainError>;
 
-    /// Moves a folder to another parent
-    async fn move_folder(&self, id: &str, dto: MoveFolderDto) -> Result<FolderDto, DomainError>;
+    /// Moves a folder to another parent (ownership verified against caller_id)
+    async fn move_folder(&self, id: &str, dto: MoveFolderDto, caller_id: &str) -> Result<FolderDto, DomainError>;
 
-    /// Deletes a folder
-    async fn delete_folder(&self, id: &str) -> Result<(), DomainError>;
+    /// Deletes a folder (ownership verified against caller_id)
+    async fn delete_folder(&self, id: &str, caller_id: &str) -> Result<(), DomainError>;
 }
 
 /**