feat(sidecar): enforce per-user BasePath on all filesystem mutations

Folder create/rename/delete/move, photo move, heap convert, and file
rename now reject paths outside the caller's BasePath (403). Sources
resolved via PhotoPrism UIDs are re-checked in movePhotoFiles. The
USER_BASEPATHS reconciler also sets upload_path so client-app uploads
land inside the user's subtree.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sidecar/handlers_rename.go

@@ -97,6 +97,9 @@ func handleRename(cfg *Config, pp *ppClient) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "path escapes originals root"})
 			return
 		}
+		if !requireUserScope(c, cfg, oldAbs, false) {
+			return
+		}
 		st, err := os.Stat(oldAbs)
 		if err != nil || !st.Mode().IsRegular() {
 			c.JSON(http.StatusNotFound, gin.H{"error": "file missing on disk"})