Add folder permissions UI and WebDAV protocol support

Permissions UI:
- FolderPermissionsDialog component with public/private toggle,
  role/user permission management, and access level badges
- Integrated into file manager toolbar (visible for folder admins)
- Backend returns accessLevel in folder detail endpoint

WebDAV server:
- Full WebDAV protocol at /webdav/ with Basic Auth (existing credentials)
- PROPFIND, GET, PUT, DELETE, MKCOL, COPY, MOVE, LOCK/UNLOCK support
- Permission-checked against existing folder access model
- In-memory lock stubs for Windows client compatibility
- 22 API integration tests covering all operations

Also fixes canAccess to check folder creator (was missing).

packages/backend/src/main.ts

@@ -18,6 +18,7 @@ import { rbacRoutes } from './routes/v1/rbac.js'
 import { repairRoutes } from './routes/v1/repairs.js'
 import { storageRoutes } from './routes/v1/storage.js'
 import { storeRoutes } from './routes/v1/store.js'
+import { webdavRoutes } from './routes/webdav/index.js'
 import { RbacService } from './services/rbac.service.js'
 
 export async function buildApp() {
@@ -71,6 +72,15 @@ export async function buildApp() {
   await app.register(repairRoutes, { prefix: '/v1' })
   await app.register(storageRoutes, { prefix: '/v1' })
   await app.register(storeRoutes, { prefix: '/v1' })
+  // Register WebDAV custom HTTP methods before routes
+  app.addHttpMethod('PROPFIND', { hasBody: true })
+  app.addHttpMethod('PROPPATCH', { hasBody: true })
+  app.addHttpMethod('MKCOL', { hasBody: true })
+  app.addHttpMethod('COPY')
+  app.addHttpMethod('MOVE')
+  app.addHttpMethod('LOCK', { hasBody: true })
+  app.addHttpMethod('UNLOCK')
+  await app.register(webdavRoutes, { prefix: '/webdav' })
 
   // Auto-seed system permissions on startup
   app.addHook('onReady', async () => {