fix(files): missing folder_id is 400, not 500

Uploading without folder_id answered `500 Internal Error: folder_id is
required to determine file owner`. A missing required field is the
caller's error; as an internal_error it produced `error_type: Internal
Error`, which the SPA cannot distinguish from the server breaking — so a
malformed request looked like an outage.

Both sites become validation_error (ErrorKind::InvalidInput → 400), with
messages that say WHY the field is needed rather than restating that it
is: the destination folder determines the file's owner and drive.

The OpenAPI request body described it as "optional folder_id field",
which is how it came to be omitted — hit while writing
thumbnail_etag_content_keyed.hurl, where the upload was written from the
documented contract and 500'd. Now stated as required.

Regression test asserts the status AND that error_type is not "Internal
Error", since the contract the SPA switches on is error_type rather than
the message.

tests/api/files-folders.hurl

@@ -357,3 +357,25 @@ Authorization: Bearer {{token}}
 HTTP 200
 [Asserts]
 header "Content-Type" startsWith "image/"
+
+
+# ─────────────────────────────────────────────────────────────
+# Step 23 – Upload without folder_id is a CLIENT error
+#
+# The destination folder determines the file's owner and drive, so the
+# field is required. It used to answer 500 / `error_type: Internal
+# Error`, which the SPA cannot distinguish from the server breaking — a
+# malformed request looked like an outage. The OpenAPI body description
+# called the field optional, which is how it came to be omitted.
+#
+# Asserts the status AND the error_type, because the contract the SPA
+# switches on is `error_type`, not the message.
+# ─────────────────────────────────────────────────────────────
+POST {{base_url}}/api/files/upload
+Authorization: Bearer {{token}}
+[MultipartFormData]
+file: file,fixtures/hello.txt; text/plain
+
+HTTP 400
+[Asserts]
+jsonpath "$.error_type" != "Internal Error"