feat(file): conceal file resource existence from other users

- feat: cross-user file access returns not-found instead of
  permission-denied
- fix: repository delete now only affects active rows and returns
  ErrNotFound when no row changes; repeated deletes yield not-found
- feat: parent directory operations (list, upload, create-dir, move)
  conceal ownership of other user's directories
- test: update handler, service, repository, and integration tests to
  assert not-found behavior for cross-user and missing file operations

docs/server/decisions.md

@@ -106,3 +106,20 @@
 - REST remains a handler/API concern, and future protocols can reuse services without HTTP leakage.
 - Error responses keep the same top-level shape, with optional `log_id` instead of embedding log references in the message.
 - Admin and auth middleware behavior is testable through service contracts rather than database access.
+
+## 2026-07-15: Conceal File Resource Existence
+
+**Context**: Returning permission-denied errors for cross-user file access allowed authenticated callers to distinguish another user's resource from a missing resource. Idempotent success for deleting missing files also conflicted with a consistent not-found concealment policy.
+
+**Decisions**:
+
+| Decision | Guidance |
+|----------|----------|
+| Conceal ownership | File and parent-directory ownership failures return the same not-found kind and safe message as missing or deleted resources. |
+| Strict delete result | Deleting an active owned file returns success once; missing, deleted, and cross-user targets return not found. |
+| Atomic soft delete | Repository deletes update only active rows and return `model.ErrNotFound` when no row changes. |
+
+**Consequences**:
+- Authenticated file operations cannot use status codes or messages to determine whether another user's resource exists.
+- A successful first delete returns `204 No Content`; repeated deletes return `404 Not Found` while remaining idempotent in effect.
+- Unauthenticated requests remain `401 Unauthorized`, non-empty directory deletion remains `409 Conflict`, and permission-denied behavior outside the file boundary remains unchanged.