fix(files,security): S-1 per-source Move authorization, S-2 session-only annotation, S-5 restore guards

S-1 (/files/move, /files/organize action=move):
- organize-guard: authorizeMoveEntities checks every source's media entities
  (declared entity plus entities of registered assets under the source);
  one-time approval still covers the whole request; any source that cannot
  be attributed to an entity only passes with an approval; denial lists every
  unauthorized item; optional non-consuming pre-check
- transfer: entities per source (directory = registered assets beneath it)
- organize: all move groups pre-checked before any group executes; any
  denial -> whole request 403 approval_required
S-2:
- api.ts: GET /files/download and POST /files/trash/purge marked
  auth:"session"; files routes attach requireAdminSession from the registry
  annotation; handler-side purge check removed, download keeps a same-rule
  defense check; permanent delete uses isAdminSession
- DEV key rule written down: equals an admin-scope key for session-only
  endpoints, still admin for Move/delete approval bypass (as authorizeMove)
- api-registry.test: session list updated; new reverse assertion that no
  non-session endpoint answers 403 to an admin-scope bearer
S-5 (trash restore):
- restore-to requires a writable managed library root (isWritableTarget)
- in-place restore rebuilds missing parents level by level without
  following symlinks (mkdirWithin), realpath-checked per level
- cross-volume restore capped by FILES_TRASH_CROSS_MAX_BYTES; cross-volume
  copies (trash in / restore out) go through fsproxy
Tests: multi-entity move 403 + listing, unattributed source, organize foreign
asset 403, download/purge 403 for DEV and admin-scope keys, restore target
not writable, symlinked parent, rebuild parents, cross-volume cap.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/test/api-registry.test.ts

@@ -60,10 +60,12 @@ describe("Api 注册表鉴权标注", () => {
       .sort();
     expect(session).toEqual([
       "GET /auth/totp",
+      "GET /files/download",
       "PATCH /approvals/{id}",
       "POST /approvals",
       "POST /auth/password",
       "POST /auth/totp",
+      "POST /files/trash/purge",
     ]);
     for (const e of listEndpoints().filter((x) => x.auth === "session")) expect(e.scope).toBe("admin");
   });
@@ -88,4 +90,36 @@ describe("Api 注册表鉴权标注", () => {
       expect(res.status, `${e.method} ${e.path}`).toBe(403);
     }
   });
+  // 验收 07 S-2 反向:没有标 auth:"session" 的端点,不得在中间件或处理器里暗中只认管理员会话。
+  // DEV key 带 admin scope,对这些端点不应拿到 403。会话中间件排在入参校验之前,所以即使空 body/query 校验失败,
+  // 暗挂的 requireAdminSession 也会先 403 暴露出来;ctx 为空壳,处理器多半 400/500,那无所谓——只要不是 403。
+  it("未标 auth:'session' 的非公开端点,admin scope 的 Bearer 不会被 403(标注与中间件不漂移)", async () => {
+    const app = createApp({
+      config: { NODE_ENV: "development", DEV_ADMIN_KEY: DEV_KEY },
+      logger: memoryLogger().logger,
+      bus: new EventBus(5),
+      role: "all",
+      version: "0.0.0-test",
+      modules: SERVER_MODULES,
+      ctx: { role: "all" } as unknown as ServerContext,
+    });
+    const forbidden: string[] = [];
+    for (const e of listEndpoints().filter((x) => x.auth !== "session" && x.auth !== "public")) {
+      const path = e.path.replace(/\{[^}]+\}/g, "00000000-0000-4000-8000-000000000000");
+      const ctl = new AbortController();
+      const res = await Promise.race([
+        app.request(`${API_PREFIX}${path}`, {
+          method: e.method.toUpperCase(),
+          headers: { authorization: `Bearer ${DEV_KEY}`, "content-type": "application/json" },
+          signal: ctl.signal,
+          ...(e.method === "get" ? {} : { body: "{}" }),
+        }),
+        new Promise<null>((r) => setTimeout(() => r(null), 2000)),
+      ]).catch(() => null);
+      ctl.abort();
+      await res?.body?.cancel().catch(() => undefined);
+      if (res?.status === 403) forbidden.push(`${e.method.toUpperCase()} ${e.path}`);
+    }
+    expect(forbidden, `以下端点实际只认会话,请在 api.ts 标 auth:"session":\n${forbidden.join("\n")}`).toEqual([]);
+  }, 60_000);
 });