fix(security): patch 3 vulnerabilities — IDOR, ownership bypass, XSS

V1: Add owner-scoped folder pagination (list_folders_by_owner_paginated)
  - New method in FolderRepository trait, PG implementation, service & handler
  - Prevents IDOR by filtering folder listings to authenticated user

V2: Enforce ownership checks on folder mutations
  - rename_folder, move_folder, delete_folder now require caller_id
  - Service verifies folder.owner_id == caller_id (returns 404 on mismatch)
  - Propagated to folder_handler, batch_handler, batch_operations, webdav_handler
  - delete_folder_with_trash upgraded from OptionalAuthUser to AuthUser
  - download_folder_zip now checks ownership before streaming

V3: Fix XSS in frontend via DOM APIs
  - sharedView.js: innerHTML → createElement + textContent
  - contextMenus.js: innerHTML → DOM construction for share dialog

Cleanup: removed unused OptionalAuthUser import, updated all stubs/mocks

static/locales/fa.json

@@ -314,5 +314,13 @@
     "accessed": "دسترسی یافته",
     "empty_state": "هنوز هیچ پروندهٔ اخیر وجود ندارد",
     "empty_hint": "پرونده‌هایی که باز می‌کنید اینجا ظاهر می‌شوند"
+  },
+  "batch": {
+    "one_selected": "۱ مورد انتخاب شده",
+    "n_selected": "{{count}} مورد انتخاب شده",
+    "confirm_delete": "آیا مطمئنید که می‌خواهید {{count}} مورد را به سطل زباله منتقل کنید؟",
+    "move_title": "انتقال {{count}} مورد",
+    "add_favorites": "افزودن به موارد علاقه‌مند",
+    "move_copy": "انتقال یا کپی"
   }
 }