fix(security): patch 3 vulnerabilities — IDOR, ownership bypass, XSS

V1: Add owner-scoped folder pagination (list_folders_by_owner_paginated)
  - New method in FolderRepository trait, PG implementation, service & handler
  - Prevents IDOR by filtering folder listings to authenticated user

V2: Enforce ownership checks on folder mutations
  - rename_folder, move_folder, delete_folder now require caller_id
  - Service verifies folder.owner_id == caller_id (returns 404 on mismatch)
  - Propagated to folder_handler, batch_handler, batch_operations, webdav_handler
  - delete_folder_with_trash upgraded from OptionalAuthUser to AuthUser
  - download_folder_zip now checks ownership before streaming

V3: Fix XSS in frontend via DOM APIs
  - sharedView.js: innerHTML → createElement + textContent
  - contextMenus.js: innerHTML → DOM construction for share dialog

Cleanup: removed unused OptionalAuthUser import, updated all stubs/mocks

static/js/ui.js

@@ -1250,8 +1250,18 @@ function initRubberBandSelection() {
 
             if (intersects) {
                 card.classList.add('selected');
+                // Sync with multiSelect module
+                if (window.multiSelect) {
+                    const info = window.multiSelect._extractInfo(card);
+                    if (info) window.multiSelect.select(info.id, info.name, info.type, info.parentId);
+                }
             } else {
                 card.classList.remove('selected');
+                // Deselect from multiSelect module
+                if (window.multiSelect) {
+                    const info = window.multiSelect._extractInfo(card);
+                    if (info) window.multiSelect.deselect(info.id);
+                }
             }
         });
     });
@@ -1260,6 +1270,8 @@ function initRubberBandSelection() {
         if (!active) return;
         active = false;
         selRect.style.display = 'none';
+        // Update the batch bar after rubber band selection completes
+        if (window.multiSelect) window.multiSelect._syncUI();
     });
 }