fix(security): patch 3 vulnerabilities — IDOR, ownership bypass, XSS

V1: Add owner-scoped folder pagination (list_folders_by_owner_paginated)
  - New method in FolderRepository trait, PG implementation, service & handler
  - Prevents IDOR by filtering folder listings to authenticated user

V2: Enforce ownership checks on folder mutations
  - rename_folder, move_folder, delete_folder now require caller_id
  - Service verifies folder.owner_id == caller_id (returns 404 on mismatch)
  - Propagated to folder_handler, batch_handler, batch_operations, webdav_handler
  - delete_folder_with_trash upgraded from OptionalAuthUser to AuthUser
  - download_folder_zip now checks ownership before streaming

V3: Fix XSS in frontend via DOM APIs
  - sharedView.js: innerHTML → createElement + textContent
  - contextMenus.js: innerHTML → DOM construction for share dialog

Cleanup: removed unused OptionalAuthUser import, updated all stubs/mocks

src/interfaces/api/handlers/batch_handler.rs

@@ -258,6 +258,7 @@ pub async fn delete_files_batch(
 /// Handler for deleting multiple folders in batch
 pub async fn delete_folders_batch(
     State(state): State<BatchHandlerState>,
+    auth_user: AuthUser,
     Json(request): Json<BatchFolderOperationRequest>,
 ) -> ApiResult<impl IntoResponse> {
     // Verify there are folders to process
@@ -274,7 +275,7 @@ pub async fn delete_folders_batch(
     // Execute batch operation
     let result = state
         .batch_service
-        .delete_folders(request.folder_ids, request.recursive)
+        .delete_folders(request.folder_ids, request.recursive, &auth_user.id)
         .await
         .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
 
@@ -555,6 +556,7 @@ pub async fn trash_batch(
 /// Handler for moving multiple folders in batch
 pub async fn move_folders_batch(
     State(state): State<BatchHandlerState>,
+    auth_user: AuthUser,
     Json(request): Json<BatchFolderOperationRequest>,
 ) -> ApiResult<impl IntoResponse> {
     if request.folder_ids.is_empty() {
@@ -569,7 +571,7 @@ pub async fn move_folders_batch(
 
     let result = state
         .batch_service
-        .move_folders(request.folder_ids, request.target_folder_id)
+        .move_folders(request.folder_ids, request.target_folder_id, &auth_user.id)
         .await
         .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;