feat(share): public folder browsing API + range support + zip

Five new public endpoints under /api/s/{token}/...:
  GET /contents
  GET /contents/{folder_id}
  GET /file/{file_id}
  GET /zip
  GET /zip/{folder_id}

All honour the unlock cookie from /verify, so password-protected
folder shares work end-to-end.

Folder/file IDs are validated against the share subtree via a single
ltree containment query (O(log N) on the existing GiST index).
Out-of-scope IDs return 404.

download_shared_file refactored to a Range/304/206/416-aware
serve_share_file helper, shared with the new /file/{file_id}
endpoint. content_disposition extracted from FileHandler so RFC 5987
formatting is identical across auth and share download paths.

src/domain/repositories/folder_repository.rs

@@ -190,4 +190,27 @@ pub trait FolderRepository: Send + Sync + 'static {
         matched.truncate(limit);
         Ok(matched)
     }
+
+    /// `true` if `candidate_folder_id` is `root_folder_id` itself or any
+    /// (transitive) descendant. Default impl fails closed so stubs deny
+    /// access by default.
+    async fn is_folder_in_subtree(
+        &self,
+        candidate_folder_id: &str,
+        root_folder_id: &str,
+    ) -> Result<bool, DomainError> {
+        let _ = (candidate_folder_id, root_folder_id);
+        Ok(false)
+    }
+
+    /// `true` if `file_id`'s parent folder lies within the subtree rooted
+    /// at `root_folder_id`.
+    async fn is_file_in_subtree(
+        &self,
+        file_id: &str,
+        root_folder_id: &str,
+    ) -> Result<bool, DomainError> {
+        let _ = (file_id, root_folder_id);
+        Ok(false)
+    }
 }