fix(security): patch 3 vulnerabilities — IDOR, ownership bypass, XSS

V1: Add owner-scoped folder pagination (list_folders_by_owner_paginated)
  - New method in FolderRepository trait, PG implementation, service & handler
  - Prevents IDOR by filtering folder listings to authenticated user

V2: Enforce ownership checks on folder mutations
  - rename_folder, move_folder, delete_folder now require caller_id
  - Service verifies folder.owner_id == caller_id (returns 404 on mismatch)
  - Propagated to folder_handler, batch_handler, batch_operations, webdav_handler
  - delete_folder_with_trash upgraded from OptionalAuthUser to AuthUser
  - download_folder_zip now checks ownership before streaming

V3: Fix XSS in frontend via DOM APIs
  - sharedView.js: innerHTML → createElement + textContent
  - contextMenus.js: innerHTML → DOM construction for share dialog

Cleanup: removed unused OptionalAuthUser import, updated all stubs/mocks

static/css/style.css

@@ -3919,7 +3919,27 @@ html[dir='rtl'] .fa-sign-out-alt {
     /* Checked via JS */
 }
 
-/* -- Batch action bar -- */
+/* ── Selection-mode header (replaces Name/Type/Size/Modified) ── */
+.list-header.selection-mode {
+    grid-template-columns: 36px 1fr;
+    background-color: #1e293b;
+    color: #fff;
+    border-bottom-color: #334155;
+}
+
+.list-header.selection-mode .list-header-checkbox input[type="checkbox"] {
+    accent-color: #ff5e3a;
+}
+
+.batch-selection-info {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 16px;
+    min-width: 0;
+}
+
+/* -- Batch action bar (grid view floating bar) -- */
 .batch-action-bar {
     display: flex;
     align-items: center;
@@ -4720,11 +4740,16 @@ html[dir='rtl'] .fa-sign-out-alt {
     color: #e2e8f0;
 }
 /* Batch bar dark mode */
-[data-theme="dark"] .batch-bar {
+[data-theme="dark"] .batch-action-bar {
     background-color: #1e293b;
     border-color: #334155;
     color: #e2e8f0;
 }
+[data-theme="dark"] .list-header.selection-mode {
+    background-color: #0f172a;
+    border-bottom-color: #334155;
+    color: #e2e8f0;
+}
 /* Search results dark mode */
 [data-theme="dark"] .search-results-header {
     color: #f1f5f9;