perf(listing): return per-item is_favorite/is_shared, drop client badge fetches

The folder listing now carries the favorite/share badge state for exactly the
items it returns, so the files browser stops fetching favorites and outgoing
shares separately. This removes the last per-navigation badge round-trips AND
fixes the correctness hole of the previous approaches: badges were derived from
only the first 200 global favorites / shares, so a favorited or shared item
outside that window showed no badge. Now every listed item is correct, and the
work is scoped to the items on screen.

Backend (`GET /api/folders/{id}/listing`):
- `FolderListingDto` gains `favorite_ids` and `shared_ids` (sorted) — listing-
  level metadata, so no churn to the many FileDto/FolderDto constructors.
- The handler computes both with two batched, index-backed queries run
  concurrently: `FavoritesService::favorited_ids` (auth.user_favorites, ANY) and
  `PgAclEngine::shared_resource_ids` (storage.role_grants by granted_by + ANY,
  which already covers public links as 'token' grants — same membership the
  /grants/outgoing/resources endpoint exposes). Both fold into the ETag.
- Public-share browsing passes empty sets (anonymous, read-only context).

Frontend:
- `listFolder` reads `favorite_ids` / `shared_ids`; the files view seeds local
  badge sets straight from the listing and updates them optimistically on
  favorite toggle / batch / share creation (via ShareDialog's `onshared`).
- Removes the session `badges` store + its fetches entirely — the listing is now
  the single, authoritative, fetch-free source.

Net: favorite/share badges cost zero extra client requests per navigation and
are correct regardless of how many favorites/shares the user has. Validated:
cargo check + clippy -D warnings (backend; integration tests need Postgres,
unavailable here), frontend npm run check + unit tests, and a headless render of
the real files route (list + grid) with the new flags present — no errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M8Vb9QHmLZnEMzHz7MrFy6

src/infrastructure/services/pg_acl_engine.rs

@@ -105,6 +105,35 @@ impl PgAclEngine {
         }
     }
 
+    /// Subset of `resource_ids` the caller has shared — i.e. has any outgoing
+    /// role grant on (a `user`/`group` grant or a `token` grant, the latter
+    /// being a public link). One batched query, mirroring the membership the
+    /// `/grants/outgoing/resources` endpoint exposes; used to stamp "shared"
+    /// badges onto a folder listing without a per-navigation grants fetch.
+    pub async fn shared_resource_ids(
+        &self,
+        granted_by: Uuid,
+        resource_ids: &[Uuid],
+    ) -> Result<HashSet<Uuid>, DomainError> {
+        if resource_ids.is_empty() {
+            return Ok(HashSet::new());
+        }
+        let rows: Vec<(Uuid,)> = sqlx::query_as(
+            r#"
+            SELECT DISTINCT resource_id
+              FROM storage.role_grants
+             WHERE granted_by = $1
+               AND resource_id = ANY($2)
+            "#,
+        )
+        .bind(granted_by)
+        .bind(resource_ids)
+        .fetch_all(self.pool.as_ref())
+        .await
+        .map_err(|e| DomainError::internal_error("PgAcl", format!("shared_resource_ids: {e}")))?;
+        Ok(rows.into_iter().map(|(id,)| id).collect())
+    }
+
     /// Creates a stub instance for tests that need to construct services
     /// without a real PostgreSQL pool. Connecting to the lazy pool will
     /// fail at runtime — only safe in tests that exercise types, not actual