perf(listing): return per-item is_favorite/is_shared, drop client badge fetches

The folder listing now carries the favorite/share badge state for exactly the
items it returns, so the files browser stops fetching favorites and outgoing
shares separately. This removes the last per-navigation badge round-trips AND
fixes the correctness hole of the previous approaches: badges were derived from
only the first 200 global favorites / shares, so a favorited or shared item
outside that window showed no badge. Now every listed item is correct, and the
work is scoped to the items on screen.

Backend (`GET /api/folders/{id}/listing`):
- `FolderListingDto` gains `favorite_ids` and `shared_ids` (sorted) — listing-
  level metadata, so no churn to the many FileDto/FolderDto constructors.
- The handler computes both with two batched, index-backed queries run
  concurrently: `FavoritesService::favorited_ids` (auth.user_favorites, ANY) and
  `PgAclEngine::shared_resource_ids` (storage.role_grants by granted_by + ANY,
  which already covers public links as 'token' grants — same membership the
  /grants/outgoing/resources endpoint exposes). Both fold into the ETag.
- Public-share browsing passes empty sets (anonymous, read-only context).

Frontend:
- `listFolder` reads `favorite_ids` / `shared_ids`; the files view seeds local
  badge sets straight from the listing and updates them optimistically on
  favorite toggle / batch / share creation (via ShareDialog's `onshared`).
- Removes the session `badges` store + its fetches entirely — the listing is now
  the single, authoritative, fetch-free source.

Net: favorite/share badges cost zero extra client requests per navigation and
are correct regardless of how many favorites/shares the user has. Validated:
cargo check + clippy -D warnings (backend; integration tests need Postgres,
unavailable here), frontend npm run check + unit tests, and a headless render of
the real files route (list + grid) with the new flags present — no errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M8Vb9QHmLZnEMzHz7MrFy6

frontend/src/lib/api/endpoints/folders.ts

@@ -13,6 +13,10 @@ const NO_CACHE: RequestInit = {
 export interface FolderListing {
 	folders: FolderItem[];
 	files: FileItem[];
+	/** Ids in this listing the caller has favorited (server-computed badge set). */
+	favoriteIds: string[];
+	/** Ids in this listing the caller has an outgoing share/grant on. */
+	sharedIds: string[];
 }
 
 /** Top-level folders for the user; the first entry is the home folder. */
@@ -37,10 +41,17 @@ export async function listFolder(folderId: string, forceRefresh = false): Promis
 	const res = await apiFetch(url, { credentials: 'same-origin', cache: 'no-store', headers });
 	if (res.status === 403) throw Object.assign(new Error('Forbidden'), { status: 403 });
 	if (!res.ok) throw new Error(`listing failed: ${res.status}`);
-	const listing = (await res.json()) as Partial<FolderListing>;
+	const listing = (await res.json()) as {
+		folders?: FolderItem[];
+		files?: FileItem[];
+		favorite_ids?: string[];
+		shared_ids?: string[];
+	};
 	return {
 		folders: Array.isArray(listing.folders) ? listing.folders : [],
-		files: Array.isArray(listing.files) ? listing.files : []
+		files: Array.isArray(listing.files) ? listing.files : [],
+		favoriteIds: Array.isArray(listing.favorite_ids) ? listing.favorite_ids : [],
+		sharedIds: Array.isArray(listing.shared_ids) ? listing.shared_ids : []
 	};
 }