- feat: cross-user file access returns not-found instead of
permission-denied
- fix: repository delete now only affects active rows and returns
ErrNotFound when no row changes; repeated deletes yield not-found
- feat: parent directory operations (list, upload, create-dir, move)
conceal ownership of other user's directories
- test: update handler, service, repository, and integration tests to
assert not-found behavior for cross-user and missing file operations
- docs: move server docs to docs/server/ and update all cross-references
- docs: move web-roadmap.md to docs/web/roadmap.md and create
docs/web/decisions.md
- docs: update AGENTS.md with separate Server and Web sections
ld