fix: sidecar response interceptor + folder proxy

- Added 401-handling response interceptor to sidecar axios instance
  (matches existing http instance) so expired/invalid tokens redirect
  to login instead of showing raw 404/401 errors
- Added GET /api/sidecar/folders — proxies PhotoPrism's
  /api/v1/folders/originals with BasePath post-filter
- Updated listFolders() frontend to call sidecar proxy
- Updated plan with remaining fixes

sidecar/main.go

@@ -105,8 +105,12 @@ func main() {
 						}
 
 						// User-scoped photos — post-filters by BasePath so review/archive
-						// tabs only show photos the user owns.
-						auth.GET("/timeline", handlePhotos(pp))
+									// tabs only show photos the user owns.
+									auth.GET("/timeline", handlePhotos(pp))
+
+									// User-scoped folders — post-filters the folder tree by BasePath
+									// so the sidebar shows only folders under the user's library root.
+									auth.GET("/folders", handleFoldersProxy(pp))
 					}
 
 	addr := cfg.ListenAddr + ":" + itoa(cfg.Port)