fix(files): review round 2, the server — locks the GC and folders read under, the mount check, the old mount name

- GC: the expiry warning marks each file conditionally on the expiry it saw, one commit each (a file
  deleted meanwhile no longer fails the run; one re-timed keeps its fresh expiry unwarned); eviction
  counts the disk again when a candidate was freed meanwhile, so it never evicts for space already free.
- Folders: a retention change locks the folder and its files, and a finishing file reads the retention
  under a share lock, so neither misses the other; a folder delete locks the files it takes home (a
  file moved out meanwhile stays put, one deleted meanwhile no longer fails the delete).
- Upload: the folder is checked before the probe and held only once the job names it.
- Dedup enqueue locks the cached asset, so a release meanwhile yields a fresh one instead of a 500.
- Mount check reads the kernel's mount table instead of comparing devices (the vfs storage driver gave
  a mounted volume the device of /), and only inside a container; the API also logs a fresh, empty
  volume in the library's place.
- Compose files fall back to DOWNLOAD_HOST_PATH; the upgrade notes cover the from-source pull.
- Folder routes call owned_or_404 directly.

backend/app/downloads/folders.py

@@ -136,7 +136,14 @@ def done_expiry(db: Session, folder_id: int | None, kept: bool) -> datetime | No
     folder that keeps files)."""
     if kept or folder_id is None:
         return None
-    days = db.execute(select(FileFolder.retention_days).where(FileFolder.id == folder_id)).scalar()
+    # Read under a share lock, held to the caller's commit: a retention change (`set_retention` locks
+    # the folder) waits for this file and restamps it too, or this read waits for the change and
+    # takes the new value — never the old value stamped on a file the change did not see.
+    days = db.execute(
+        select(FileFolder.retention_days)
+        .where(FileFolder.id == folder_id)
+        .with_for_update(read=True)
+    ).scalar()
     return None if days is None else datetime.now(timezone.utc) + timedelta(days=days)
 
 
@@ -208,18 +215,30 @@ def set_retention(db: Session, folder: FileFolder, days: int | None) -> None:
     """Change how long `folder` keeps a file (None = until deleted). The done files already in it
     move by the difference — each keeps the age it has — but none ends up closer than the GC's
     warning window, so a shortened retention still warns before it takes anything."""
+    # Wait out a file being put in it or stamped from it right now (`own_folder`, `done_expiry`), so
+    # that file is among the ones restamped below. Re-read: another change may have landed first.
+    db.execute(
+        select(FileFolder)
+        .where(FileFolder.id == folder.id)
+        .with_for_update()
+        .execution_options(populate_existing=True)
+    )
     old = folder.retention_days
     if old == days:
         return
     folder.retention_days = days
     now = datetime.now(timezone.utc)
     floor = now + timedelta(days=sysconfig.get_int(db, "download_gc_grace_days"))
+    # Locked as they are read: one moved out or deleted meanwhile is no longer this folder's to time.
     jobs = db.execute(
-        select(DownloadJob).where(
+        select(DownloadJob)
+        .where(
             DownloadJob.folder_id == folder.id,
             DownloadJob.status == JobStatus.DONE,
             DownloadJob.kept.is_(False),
         )
+        .with_for_update()
+        .execution_options(populate_existing=True)
     ).scalars()
     for job in jobs:
         if days is None:
@@ -238,7 +257,18 @@ def delete_own(db: Session, folder: FileFolder) -> int:
         raise FolderError("file_folder_not_own")
     # Wait out a file being put in it right now (`own_folder`), then take that one home too.
     db.execute(select(FileFolder.id).where(FileFolder.id == folder.id).with_for_update())
-    jobs = db.execute(select(DownloadJob).where(DownloadJob.folder_id == folder.id)).scalars().all()
+    # Locked as they are read: a file moved out meanwhile stays where it went, and one deleted
+    # meanwhile is not written back (its gone row would fail the delete).
+    jobs = (
+        db.execute(
+            select(DownloadJob)
+            .where(DownloadJob.folder_id == folder.id)
+            .with_for_update()
+            .execution_options(populate_existing=True)
+        )
+        .scalars()
+        .all()
+    )
     for job in jobs:
         job.folder_id = source_folder(db, job.user_id, source_key_for(db, job)).id
         restamp(db, job)