fix(library): scope source_dirs to current user in /stats

Without this, a non-admin hitting /api/v1/library/stats would see
every other user's active SourceRoot path in the response (e.g.
muli would see /nextcloud-users/admin/files/Photos). Cross-user
visibility into Nextcloud paths is a small info leak in a multi-user
setup. Admins still get the global list when they pass scope=global.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/routers/library.py

@@ -112,11 +112,14 @@ async def get_library_stats(
 
     size = (await db.execute(select(func.sum(Photo.file_size)).where(owner))).scalar() or 0
 
-    # Source root directories (active ones only).
+    # Source root directories (active ones only). Scoped to the
+    # requesting user unless they're an admin asking for global view —
+    # otherwise the Settings panel would leak other users' NC paths.
+    sr_query = select(SourceRoot.path).where(SourceRoot.is_active.is_(True))
+    if not (scope == "global" and current_user.role == "admin"):
+        sr_query = sr_query.where(SourceRoot.user_id == current_user.id)
     roots = (
-        await db.execute(
+        await db.execute(sr_query.order_by(SourceRoot.path))
-            select(SourceRoot.path).where(SourceRoot.is_active.is_(True)).order_by(SourceRoot.path)
-        )
     ).scalars().all()
 
     return {