fix(upload): sanitize multipart filename for folder uploads (#121)

Browsers send the full relative path (e.g. 'Screenshots/file.png') as
the multipart filename when uploading folders via webkitRelativePath.
The File entity rejects names containing '/' or '\', causing all files
in a folder upload to fail with 'Invalid file name'.

Three fixes:
- Backend: strip path components from multipart filename in file_handler,
  keeping only the basename. Also prevents path-traversal attacks.
- Frontend (fileOperations.js): explicitly pass file.name as the third
  argument to FormData.append() in uploadFolderFiles() to override the
  browser's relative path.
- Frontend (ui.js): detect folder drops in drag-and-drop handlers by
  checking webkitRelativePath, and route them to uploadFolderFiles()
  instead of uploadFiles() so subfolders are created first.

Closes #121

src/interfaces/api/handlers/file_handler.rs

@@ -64,7 +64,19 @@ impl FileHandler {
             }
 
             if name == "file" {
-                let filename = field.file_name().unwrap_or("unnamed").to_string();
+                let raw_filename = field.file_name().unwrap_or("unnamed").to_string();
+                // Browsers send the full relative path (e.g. "Screenshots/file.png")
+                // as the filename for folder uploads via webkitRelativePath.
+                // Strip path components to get the basename only.
+                // This also prevents path-traversal attacks.
+                let filename = raw_filename
+                    .rsplit('/')
+                    .next()
+                    .unwrap_or(&raw_filename)
+                    .rsplit('\\')
+                    .next()
+                    .unwrap_or(&raw_filename)
+                    .to_string();
                 let content_type = field
                     .content_type()
                     .unwrap_or("application/octet-stream")