security: fix vulnerabilities 1-7 from security audit

- Fix #1: Share handler IDOR - enforce owner check on share operations
- Fix #2: list_files_query IDOR - bind folder queries to authenticated user
- Fix #3: Dedup handler IDOR - restrict dedup operations to file owner
- Fix #4: Trash handler OptionalAuthUser - require full AuthUser
- Fix #5: Error info leakage - sanitize 500 error responses
- Fix #6: Chunked upload IDOR - bind upload sessions to user_id,
  add verify_session_owner() check on all session operations
- Fix #7: CSP unsafe-inline removal - migrate all inline scripts,
  styles and event handlers to external files, tighten CSP to
  script-src 'self'; style-src 'self'

New files:
  - static/js/core/theme-init.js (render-blocking theme init)
  - static/js/core/sw-register.js (service worker registration)
  - static/css/views/device-verify.css (extracted inline styles)
  - static/js/views/device-verify/device-verify.js (extracted inline script)

src/infrastructure/services/dedup_service.rs

@@ -410,6 +410,22 @@ impl DedupService {
             .unwrap_or(false)
     }
 
+    /// Returns `true` if `user_id` owns at least one (non-trashed) file that
+    /// references the blob identified by `hash`.
+    ///
+    /// Used by the dedup API handlers to enforce per-user access control on
+    /// the content-addressed blob store.
+    pub async fn user_owns_blob_reference(&self, hash: &str, user_id: &str) -> bool {
+        sqlx::query_scalar::<_, bool>(
+            "SELECT EXISTS(SELECT 1 FROM storage.files WHERE blob_hash = $1 AND user_id = $2 AND NOT is_trashed)",
+        )
+        .bind(hash)
+        .bind(user_id)
+        .fetch_one(self.pool.as_ref())
+        .await
+        .unwrap_or(false)
+    }
+
     /// Get metadata for a blob from PostgreSQL.
     pub async fn get_blob_metadata(&self, hash: &str) -> Option<BlobMetadataDto> {
         let row = sqlx::query_as::<_, (String, i64, i32, Option<String>)>(