feat(files): the Files library API — folders, moving and keeping files, upload into a folder, the file's hash

/api/files is the library's home: list a user's done files (by folder, searched, sorted, or the
ones shared with them), rename / move / keep / delete a file, make, rename and delete own folders
(a deleted folder's files go back to their source folders), and set how long any folder keeps a
file — done files shift by the difference, never closer than the GC's warning window.

An upload can name its folder (an own folder or Uploads), checked before the body is read and again
before the file lands; it is hashed while it streams, and any file can be hashed on first ask. The
download says the hash (Repr-Digest) once it is known; a new file at an asset's path forgets it.

Uploads, deletes, keeps, moves and folder changes are audited (ids only). The fileless "expired"
rows of the old retention are deleted by migration 0103: an expired file now leaves the library.

The shared route helpers moved to routes/files.py; the old /api/downloads library routes delegate
to the new ones until the client moves over.

frontend/src/i18n/backendIds.contract.test.ts

@@ -141,7 +141,7 @@ const goneWhats = [
 ];
 // Every generic refusal → `errors.refused.<reason>`: each `refused(<status>, "<reason>")` anywhere in
 // the backend (not `_refused`, a router's own family), plus the values of the settings map, which
-// `setting_refused` picks from at runtime.
+// `setting_refused` picks from at runtime, and every `FolderError` reason.
 const appSources = (dir = ""): string[] =>
   readdirSync(new URL(`../../../backend/app/${dir}`, import.meta.url), {
     withFileTypes: true,
@@ -157,6 +157,11 @@ const refusedReasons = [
     ...appSources().flatMap((src) =>
       [...src.matchAll(/(?<![\w.])refused\(\s*\d+,\s*"(\w+)"/g)].map((m) => m[1]!),
     ),
+    // A folder change the rules refuse travels as `FolderError("<reason>")` and is answered with
+    // `refused(409, e.reason)`, which the pattern above cannot read.
+    ...appSources().flatMap((src) =>
+      [...src.matchAll(/FolderError\("(\w+)"\)/g)].map((m) => m[1]!),
+    ),
     ...[
       ...(backend("refusal.py").split("_SETTING_REASONS = {")[1]?.split("}")[0] ?? "").matchAll(
         /:\s*"(\w+)"/g,