fix(files,security): S-1 per-source Move authorization, S-2 session-only annotation, S-5 restore guards

S-1 (/files/move, /files/organize action=move):
- organize-guard: authorizeMoveEntities checks every source's media entities
  (declared entity plus entities of registered assets under the source);
  one-time approval still covers the whole request; any source that cannot
  be attributed to an entity only passes with an approval; denial lists every
  unauthorized item; optional non-consuming pre-check
- transfer: entities per source (directory = registered assets beneath it)
- organize: all move groups pre-checked before any group executes; any
  denial -> whole request 403 approval_required
S-2:
- api.ts: GET /files/download and POST /files/trash/purge marked
  auth:"session"; files routes attach requireAdminSession from the registry
  annotation; handler-side purge check removed, download keeps a same-rule
  defense check; permanent delete uses isAdminSession
- DEV key rule written down: equals an admin-scope key for session-only
  endpoints, still admin for Move/delete approval bypass (as authorizeMove)
- api-registry.test: session list updated; new reverse assertion that no
  non-session endpoint answers 403 to an admin-scope bearer
S-5 (trash restore):
- restore-to requires a writable managed library root (isWritableTarget)
- in-place restore rebuilds missing parents level by level without
  following symlinks (mkdirWithin), realpath-checked per level
- cross-volume restore capped by FILES_TRASH_CROSS_MAX_BYTES; cross-volume
  copies (trash in / restore out) go through fsproxy
Tests: multi-entity move 403 + listing, unattributed source, organize foreign
asset 403, download/purge 403 for DEV and admin-scope keys, restore target
not writable, symlinked parent, rebuild parents, cross-volume cap.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/test/file-manager/identify-organize.test.ts

@@ -1,7 +1,16 @@
 import { appendFile, mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
-import { createFmHarness, type FmHarness, key, pgAvailable, READ_KEY, seedAsset, seedEntity } from "./harness.ts";
+import {
+  createFmHarness,
+  EXEC_KEY,
+  type FmHarness,
+  key,
+  pgAvailable,
+  READ_KEY,
+  seedAsset,
+  seedEntity,
+} from "./harness.ts";
 
 // identify(只读,本地 + 远端召回前 5,不落库)、organize(按作品分组走 planImport,dryRun→execute 一致与源变更)、
 // probe(已登记写回 media_info)、scrape(仅已登记作品,入队 refreshMetadata;NFO 待 W5)。
@@ -114,6 +123,42 @@ describe.skipIf(skip)("files 识别 / 整理 / 探测 / 刮削", () => {
     expect(rec).toEqual({ trigger: "manual", action: "copy", media_entity_id: film });
   });
 
+  it("organize Move(验收 07 S-1):源是别的作品的已登记资产 → 只授权声明作品不够,整体 403 并列出", async () => {
+    const other = await seedEntity(h.db, { kind: "movie", title: "Other Film", year: 2020 });
+    await mkdir(join(h.lib, "Stolen"), { recursive: true });
+    await writeFile(join(h.lib, "Stolen", "Blue.Film.2021.2160p.BluRay.x265-GRP.mkv"), "someone-else");
+    await seedAsset(h.db, h, { entityId: other, rel: "Stolen/Blue.Film.2021.2160p.BluRay.x265-GRP.mkv" });
+    const grant = await h.db
+      .insertInto("automation_grant")
+      .values({ action: "organize.execute", scope: JSON.stringify({ mediaEntityIds: [film] }), granted_by: "test" })
+      .returning("id")
+      .executeTakeFirstOrThrow();
+    const items = [{ root: h.libRoot, path: "Stolen/Blue.Film.2021.2160p.BluRay.x265-GRP.mkv", mediaEntityId: film }];
+    const dry = await h.api(
+      "POST",
+      "/files/organize",
+      { idempotencyKey: key(), items, action: "move", dryRun: true },
+      EXEC_KEY,
+    );
+    expect(dry.status).toBe(200);
+    const r = await h.api(
+      "POST",
+      "/files/organize",
+      { idempotencyKey: key(), items, action: "move", dryRun: false, planIds: [dry.body.data.groups[0].planId] },
+      EXEC_KEY,
+    );
+    expect(r.status).toBe(403);
+    expect(r.body.error.message).toMatch(/^approval_required:/);
+    expect(r.body.error.message).toContain(other);
+    const recs = await h.db
+      .selectFrom("organization_record")
+      .select("id")
+      .where("source_path", "like", "%Stolen%")
+      .execute();
+    expect(recs).toEqual([]);
+    await h.db.updateTable("automation_grant").set({ status: "revoked" }).where("id", "=", grant.id).execute();
+  });
+
   it("organize:路径逃逸同样拒绝", async () => {
     const r = await h.api("POST", "/files/organize", {
       idempotencyKey: key(),