security: fix vulnerabilities 1-7 from security audit

- Fix #1: Share handler IDOR - enforce owner check on share operations
- Fix #2: list_files_query IDOR - bind folder queries to authenticated user
- Fix #3: Dedup handler IDOR - restrict dedup operations to file owner
- Fix #4: Trash handler OptionalAuthUser - require full AuthUser
- Fix #5: Error info leakage - sanitize 500 error responses
- Fix #6: Chunked upload IDOR - bind upload sessions to user_id,
  add verify_session_owner() check on all session operations
- Fix #7: CSP unsafe-inline removal - migrate all inline scripts,
  styles and event handlers to external files, tighten CSP to
  script-src 'self'; style-src 'self'

New files:
  - static/js/core/theme-init.js (render-blocking theme init)
  - static/js/core/sw-register.js (service worker registration)
  - static/css/views/device-verify.css (extracted inline styles)
  - static/js/views/device-verify/device-verify.js (extracted inline script)

src/application/ports/chunked_upload_ports.rs

@@ -59,6 +59,7 @@ pub trait ChunkedUploadPort: Send + Sync + 'static {
     /// total number of chunks, and expiration timestamp.
     async fn create_session(
         &self,
+        user_id: &str,
         filename: String,
         folder_id: Option<String>,
         content_type: String,
@@ -72,13 +73,14 @@ pub trait ChunkedUploadPort: Send + Sync + 'static {
     async fn upload_chunk(
         &self,
         upload_id: &str,
+        user_id: &str,
         chunk_index: usize,
         data: Bytes,
         checksum: Option<String>,
     ) -> Result<ChunkUploadResponseDto, DomainError>;
 
     /// Get the current status of an upload session.
-    async fn get_status(&self, upload_id: &str) -> Result<UploadStatusResponseDto, DomainError>;
+    async fn get_status(&self, upload_id: &str, user_id: &str) -> Result<UploadStatusResponseDto, DomainError>;
 
     /// Assemble all chunks into the final file.
     ///
@@ -88,13 +90,14 @@ pub trait ChunkedUploadPort: Send + Sync + 'static {
     async fn complete_upload(
         &self,
         upload_id: &str,
+        user_id: &str,
     ) -> Result<(PathBuf, String, Option<String>, String, u64, String), DomainError>;
 
     /// Finalize upload: clean up the session and temporary files.
-    async fn finalize_upload(&self, upload_id: &str) -> Result<(), DomainError>;
+    async fn finalize_upload(&self, upload_id: &str, user_id: &str) -> Result<(), DomainError>;
 
     /// Cancel an upload and clean up all temporary data.
-    async fn cancel_upload(&self, upload_id: &str) -> Result<(), DomainError>;
+    async fn cancel_upload(&self, upload_id: &str, user_id: &str) -> Result<(), DomainError>;
 
     /// Check if a file size qualifies for chunked upload.
     fn should_use_chunked(&self, size: u64) -> bool;