- /u/:token/files now lists a single directory level with type info,
/u/:token/zip streams a ZIP of any folder (whole customer dir by
default). Both paths apply realpath containment so a symlink dropped
into the customer folder via WebDAV cannot escape — listing now 404s
on out-of-base symlinks the same way the file download already did.
- Frontend gets breadcrumbs, folder navigation and per-folder/whole-
current-folder ZIP buttons; UNC \\HOST@PORT\DavWWWRoot\ form is
derived from the configured WebDAV URL and shown next to it.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Stefan HackerandClaude Opus 4.6
fd5e917249