feat(mounts): P2 — read-write REST for external mounts

Adds full CRUD on mount contents, mirroring the P1 read pattern (handlers/
services classify; authorization stays in the service via the mount-root
folder grant; the provider does the I/O).

- mkdir / rename / delete / move-within branch inside FolderService and
  FileManagementService (router injected into both)
- streaming upload via a new ExternalUploadService: the upload handler detects a
  mount destination BEFORE the CAS ingest and streams the multipart body
  straight to the provider (no BLAKE3/dedup). `write_stream` now takes a
  lifetime-bound boxed stream so the borrowing multipart field can be passed
  without buffering.
- deletes on mounts are permanent (no trash): the trash-first folder handler
  routes `ext:` ids straight to the provider delete; file delete goes through the
  branched delete_and_cleanup
- cross-backend move/copy (mount ↔ native, or between mounts) is forbidden
  (UnsupportedOperation); the mount root itself cannot be renamed/moved/deleted
- every mutation emits a `target:"audit" event="external_mount.write"` line
- shared mount_dto builders synthesize FolderDto/FileDto from a provider MountStat

Tests: 529 unit + integration tests for mkdir/rename/delete, file rename/delete,
streaming upload, cross-boundary forbid, and stranger-denied — all against real
Postgres + a real provider (testcontainers).

src/application/services/mod.rs

@@ -10,6 +10,7 @@ pub mod device_auth_service;
 pub mod drive_management_service;
 pub mod external_identity_service;
 pub mod external_mount_router;
+pub mod external_upload_service;
 pub mod favorites_service;
 pub mod file_lifecycle_service;
 pub mod file_management_service;
@@ -19,6 +20,7 @@ pub mod file_use_case_factory;
 pub mod folder_service;
 pub mod i18n_application_service;
 pub mod magic_link_invite_service;
+pub mod mount_dto;
 pub mod mount_registry;
 pub mod music_service;
 pub mod nextcloud_file_id_service;