security: fix vulnerabilities 1-7 from security audit

- Fix #1: Share handler IDOR - enforce owner check on share operations
- Fix #2: list_files_query IDOR - bind folder queries to authenticated user
- Fix #3: Dedup handler IDOR - restrict dedup operations to file owner
- Fix #4: Trash handler OptionalAuthUser - require full AuthUser
- Fix #5: Error info leakage - sanitize 500 error responses
- Fix #6: Chunked upload IDOR - bind upload sessions to user_id,
  add verify_session_owner() check on all session operations
- Fix #7: CSP unsafe-inline removal - migrate all inline scripts,
  styles and event handlers to external files, tighten CSP to
  script-src 'self'; style-src 'self'

New files:
  - static/js/core/theme-init.js (render-blocking theme init)
  - static/js/core/sw-register.js (service worker registration)
  - static/css/views/device-verify.css (extracted inline styles)
  - static/js/views/device-verify/device-verify.js (extracted inline script)

src/interfaces/api/handlers/favorites_handler.rs

@@ -42,7 +42,7 @@ pub async fn get_favorites(
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(serde_json::json!({
-                    "error": format!("Failed to retrieve favorites: {}", err)
+                    "error": "Failed to retrieve favorites"
                 })),
             )
                 .into_response()
@@ -86,7 +86,7 @@ pub async fn add_favorite(
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(serde_json::json!({
-                    "error": format!("Failed to add to favorites: {}", err)
+                    "error": "Failed to add to favorites"
                 })),
             )
         }
@@ -129,7 +129,7 @@ pub async fn remove_favorite(
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(serde_json::json!({
-                    "error": format!("Failed to remove from favorites: {}", err)
+                    "error": "Failed to remove from favorites"
                 })),
             )
         }
@@ -188,7 +188,7 @@ pub async fn batch_add_favorites(
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
                 Json(serde_json::json!({
-                    "error": format!("Failed to batch add favorites: {}", err)
+                    "error": "Failed to batch add favorites"
                 })),
             )
                 .into_response()