fix(security): patch critical IDOR & auth vulnerabilities

- Fix logout no-op: extract refresh token from cookie/body (auth_handler)
- Secure all 12 WebDAV handlers with AuthUser + resolve_path_for_user
- Secure all 7 batch handlers with caller_id ownership checks
- Add _owned variants: copy_file_owned, delete_file_owned, get_file_stream_owned, get_folder_owned
- Secure list_files_query: add AuthUser, SQL-level user_id filter, tenant-isolated ETag
- Remove deprecated unscoped resolve_path() and exists() from PathResolverService
- Remove dead list_files handler (unmounted, no auth)
- Add list_files_for_owner (SQL) and list_files_owned across trait chain

src/application/services/folder_service.rs

@@ -32,6 +32,10 @@ impl FolderService {
                 Ok(FolderDto::empty())
             }
 
+            async fn get_folder_owned(&self, _id: &str, _caller_id: &str) -> Result<FolderDto, DomainError> {
+                Ok(FolderDto::empty())
+            }
+
             async fn get_folder_by_path(&self, _path: &str) -> Result<FolderDto, DomainError> {
                 Ok(FolderDto::empty())
             }
@@ -196,6 +200,21 @@ impl FolderUseCase for FolderService {
         Ok(FolderDto::from(folder))
     }
 
+    /// Gets a folder by its ID, enforcing that `caller_id` is the owner.
+    async fn get_folder_owned(&self, id: &str, caller_id: &str) -> Result<FolderDto, DomainError> {
+        let folder_dto = self.get_folder(id).await?;
+        if folder_dto.owner_id.as_deref() != Some(caller_id) {
+            tracing::warn!(
+                "get_folder_owned: user '{}' attempted to access folder '{}' owned by '{:?}'",
+                caller_id,
+                id,
+                folder_dto.owner_id
+            );
+            return Err(DomainError::not_found("Folder", id));
+        }
+        Ok(folder_dto)
+    }
+
     /// Gets a folder by its path
     async fn get_folder_by_path(&self, path: &str) -> Result<FolderDto, DomainError> {
         // Convert the string path to StoragePath