Merge branch 'main' into claude/performance-optimization-round-6

Resolves the one conflict in file_blob_read_repository.rs's
suggest_files_by_name: main added the CALLER_CAN_READ_DRIVE authz scope
(caller_id param + drive-membership filter, AuthZ audit finding #1 — the
suggest query previously leaked names/paths across tenants), round 6
switched the same query's id/folder_id columns to binary UUID decode.
Kept both: main's authz structure (format! + CALLER_CAN_READ_DRIVE +
caller_id bind) with round 6's binary decode (fi.id / fi.folder_id, no
::text) so the query matches the FileRow = (Uuid, …) tuple. The
deliberately-text sites (min(fm.file_id::text), folder path lookup)
stay text. Verified: build + clippy -D warnings clean, 524 unit +
554 integration tests green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017aJu9ghvuT8WqC31ZEGTBA

src/domain/repositories/folder_repository.rs

@@ -269,13 +269,21 @@ pub trait FolderRepository: Send + Sync + 'static {
     /// Results are ordered by relevance (exact > starts-with > contains) for
     /// autocomplete suggestions.
     ///
+    /// `caller_id` scopes results to folders whose owning drive the caller
+    /// can Read (direct or group-mediated `role_grants`). Without it the
+    /// endpoint leaked names + paths across every tenant on the instance —
+    /// closed as AuthZ audit finding #1 (2026-07-12).
+    ///
     /// The default implementation falls back to `list_folders` + in-memory
-    /// filter so that stubs and mocks compile without changes.
+    /// filter so that stubs and mocks compile without changes. Stub-mode
+    /// callers already operate against a single tenant's data, so ignoring
+    /// `caller_id` here is safe; the PG impl enforces the real scope.
     async fn suggest_folders_by_name(
         &self,
         parent_id: Option<&str>,
         query: &str,
         limit: usize,
+        _caller_id: uuid::Uuid,
     ) -> Result<Vec<Folder>, DomainError> {
         let all = self.list_folders(parent_id).await?;
         let q = query.to_lowercase();