feat(file): conceal file resource existence from other users

- feat: cross-user file access returns not-found instead of
  permission-denied
- fix: repository delete now only affects active rows and returns
  ErrNotFound when no row changes; repeated deletes yield not-found
- feat: parent directory operations (list, upload, create-dir, move)
  conceal ownership of other user's directories
- test: update handler, service, repository, and integration tests to
  assert not-found behavior for cross-user and missing file operations

internal/repository/file_test.go

@@ -2,6 +2,7 @@ package repository
 
 import (
 	"context"
+	"errors"
 	"testing"
 
 	"gorm.io/driver/sqlite"
@@ -259,7 +260,7 @@ func TestFileRepository_StatusFilter(t *testing.T) {
 	}
 }
 
-func TestFileRepository_DeleteIdempotent(t *testing.T) {
+func TestFileRepository_DeleteReturnsNotFoundAfterDeletion(t *testing.T) {
 	repo := setupFileRepo(t)
 	ctx := context.Background()
 
@@ -276,8 +277,11 @@ func TestFileRepository_DeleteIdempotent(t *testing.T) {
 	if err := repo.Delete(ctx, "file-1"); err != nil {
 		t.Fatalf("first Delete = %v", err)
 	}
-	if err := repo.Delete(ctx, "file-1"); err != nil {
-		t.Fatalf("second Delete = %v", err)
+	if err := repo.Delete(ctx, "file-1"); !errors.Is(err, model.ErrNotFound) {
+		t.Fatalf("second Delete = %v, want ErrNotFound", err)
+	}
+	if err := repo.Delete(ctx, "missing-file"); !errors.Is(err, model.ErrNotFound) {
+		t.Fatalf("missing Delete = %v, want ErrNotFound", err)
 	}
 }