fix(security): patch critical IDOR & auth vulnerabilities

- Fix logout no-op: extract refresh token from cookie/body (auth_handler)
- Secure all 12 WebDAV handlers with AuthUser + resolve_path_for_user
- Secure all 7 batch handlers with caller_id ownership checks
- Add _owned variants: copy_file_owned, delete_file_owned, get_file_stream_owned, get_folder_owned
- Secure list_files_query: add AuthUser, SQL-level user_id filter, tenant-isolated ETag
- Remove deprecated unscoped resolve_path() and exists() from PathResolverService
- Remove dead list_files handler (unmounted, no auth)
- Add list_files_for_owner (SQL) and list_files_owned across trait chain

src/application/services/file_management_service.rs

@@ -128,6 +128,16 @@ impl FileManagementUseCase for FileManagementService {
         Ok(FileDto::from(copied_file))
     }
 
+    async fn copy_file_owned(
+        &self,
+        file_id: &str,
+        caller_id: &str,
+        target_folder_id: Option<String>,
+    ) -> Result<FileDto, DomainError> {
+        self.verify_owner(file_id, caller_id).await?;
+        self.copy_file(file_id, target_folder_id).await
+    }
+
     async fn rename_file(&self, file_id: &str, new_name: &str) -> Result<FileDto, DomainError> {
         info!("Renaming file with ID: {} to \"{}\"", file_id, new_name);
 
@@ -163,6 +173,11 @@ impl FileManagementUseCase for FileManagementService {
         self.file_repository.delete_file(id).await
     }
 
+    async fn delete_file_owned(&self, id: &str, caller_id: &str) -> Result<(), DomainError> {
+        self.verify_owner(id, caller_id).await?;
+        self.delete_file(id).await
+    }
+
     /// Smart delete: trash-first with dedup reference cleanup.
     ///
     /// Blob ref_count bookkeeping is handled entirely by the PG trigger