fix(security): patch critical IDOR & auth vulnerabilities

- Fix logout no-op: extract refresh token from cookie/body (auth_handler)
- Secure all 12 WebDAV handlers with AuthUser + resolve_path_for_user
- Secure all 7 batch handlers with caller_id ownership checks
- Add _owned variants: copy_file_owned, delete_file_owned, get_file_stream_owned, get_folder_owned
- Secure list_files_query: add AuthUser, SQL-level user_id filter, tenant-isolated ETag
- Remove deprecated unscoped resolve_path() and exists() from PathResolverService
- Remove dead list_files handler (unmounted, no auth)
- Add list_files_for_owner (SQL) and list_files_owned across trait chain

src/application/services/file_retrieval_service.rs

@@ -223,6 +223,15 @@ impl FileRetrievalUseCase for FileRetrievalService {
         Ok(files.into_iter().map(FileDto::from).collect())
     }
 
+    async fn list_files_owned(
+        &self,
+        folder_id: Option<&str>,
+        owner_id: &str,
+    ) -> Result<Vec<FileDto>, DomainError> {
+        let files = self.file_read.list_files_for_owner(folder_id, owner_id).await?;
+        Ok(files.into_iter().map(FileDto::from).collect())
+    }
+
     async fn get_file_stream(
         &self,
         id: &str,
@@ -230,6 +239,15 @@ impl FileRetrievalUseCase for FileRetrievalService {
         self.file_read.get_file_stream(id).await
     }
 
+    async fn get_file_stream_owned(
+        &self,
+        id: &str,
+        caller_id: &str,
+    ) -> Result<Box<dyn Stream<Item = Result<Bytes, std::io::Error>> + Send>, DomainError> {
+        self.file_read.verify_file_owner(id, caller_id).await?;
+        self.file_read.get_file_stream(id).await
+    }
+
     /// Multi-tier optimized download.
     async fn get_file_optimized(
         &self,
@@ -311,4 +329,18 @@ impl FileRetrievalUseCase for FileRetrievalService {
             .await?;
         Ok(files.into_iter().map(FileDto::from).collect())
     }
+
+    async fn list_files_batch_for_owner(
+        &self,
+        folder_id: Option<&str>,
+        owner_id: &str,
+        offset: i64,
+        limit: i64,
+    ) -> Result<Vec<FileDto>, DomainError> {
+        let files = self
+            .file_read
+            .list_files_batch_for_owner(folder_id, owner_id, offset, limit)
+            .await?;
+        Ok(files.into_iter().map(FileDto::from).collect())
+    }
 }