Merge upstream/main into feat/external-file-mounts

Resolve conflicts between the external-file-mounts feature and upstream's
D5/D7 refactor (per-file provenance, keyset pagination, cross-drive move
gates, resource-access hook, folder-cascade lifecycle hook).

Key resolutions:
- FolderService::new now takes (repo, authz, file_lifecycle, mount_router);
  all callers + DI updated.
- FileRetrievalService / FileManagementService keep both the mount_router
  and the new resource_access_hook / drive_repo / storage_usage wiring.
- list_files_batch_with_perms: adapt the mount branch from offset- to
  keyset (after_name) pagination, mirroring paginate_mount_entries.
- download_file_impl: keep upstream's &HeaderMap + `impl IntoResponse + use<>`
  signature, retain the mount-download branch.
- Mount DTOs: the retired `owner_id` field maps onto created_by/updated_by
  (the mount owner) — the fields the frontend now uses for owner display.
- admin/+page.svelte: keep upstream's user-delete modal + the 'mounts' tab.
- Bump memmap2 0.9.10 -> 0.9.11 (RUSTSEC critical advisory fix) and
  regenerate Cargo.lock against the merged Cargo.toml.

src/application/services/batch_operations_test.rs

@@ -10,6 +10,7 @@ mod tests {
     use crate::application::services::batch_operations::{
         BatchOperationService, BatchResult, BatchStats,
     };
+    use crate::application::services::file_lifecycle_service::FileLifecycleService;
     use crate::application::services::file_management_service::FileManagementService;
     use crate::application::services::file_retrieval_service::FileRetrievalService;
     use crate::application::services::folder_service::FolderService;
@@ -105,7 +106,12 @@ mod tests {
                 crate::application::services::mount_registry::MountRegistry::empty(),
             )),
         );
-        let folder_service = Arc::new(FolderService::new(folder_repo, authz, mount_router));
+        let folder_service = Arc::new(FolderService::new(
+            folder_repo,
+            authz,
+            Arc::new(FileLifecycleService::new()),
+            mount_router,
+        ));
 
         let _batch_service = BatchOperationService::new(
             file_retrieval,