- feat: cross-user file access returns not-found instead of
permission-denied
- fix: repository delete now only affects active rows and returns
ErrNotFound when no row changes; repeated deletes yield not-found
- feat: parent directory operations (list, upload, create-dir, move)
conceal ownership of other user's directories
- test: update handler, service, repository, and integration tests to
assert not-found behavior for cross-user and missing file operations
enforcement
- test: cover authenticated register, login, upload, list, and download
flow
- test: verify file API routes reject test identity header injection
- test: verify file API routes reject invalid, expired, and malformed
tokens
- test: verify cross-user ownership isolation for all file CRUD
operations
- refactor: rename test-only header constant to clarify it is not used
in production
ld