security: fix vulnerabilities 1-7 from security audit

- Fix #1: Share handler IDOR - enforce owner check on share operations
- Fix #2: list_files_query IDOR - bind folder queries to authenticated user
- Fix #3: Dedup handler IDOR - restrict dedup operations to file owner
- Fix #4: Trash handler OptionalAuthUser - require full AuthUser
- Fix #5: Error info leakage - sanitize 500 error responses
- Fix #6: Chunked upload IDOR - bind upload sessions to user_id,
  add verify_session_owner() check on all session operations
- Fix #7: CSP unsafe-inline removal - migrate all inline scripts,
  styles and event handlers to external files, tighten CSP to
  script-src 'self'; style-src 'self'

New files:
  - static/js/core/theme-init.js (render-blocking theme init)
  - static/js/core/sw-register.js (service worker registration)
  - static/css/views/device-verify.css (extracted inline styles)
  - static/js/views/device-verify/device-verify.js (extracted inline script)

static/profile.html

@@ -4,7 +4,7 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>OxiCloud — My Profile</title>
-<script>if(localStorage.getItem('oxicloud_theme')==='dark')document.documentElement.setAttribute('data-theme','dark');</script>
+<script src="/js/core/theme-init.js"></script>
 <script src="/js/core/icons.js" defer></script>
 <script src="/js/core/csrf.js" defer></script>
 <link rel="stylesheet" href="/css/main.css">
@@ -96,7 +96,7 @@
 
     <div class="profile-card" id="password-section">
       <h2><i class="fas fa-key"></i> Change Password</h2>
-      <form id="password-form" onsubmit="return changePassword(event)">
+      <form id="password-form">
         <div class="form-group">
           <label for="current-password">Current Password</label>
           <input type="password" id="current-password" required autocomplete="current-password">