feat: stream folder downloads as zip

[arnabnandy7]

Summary

• Added GET /api/folders/download?path=<relative-folder> for downloading folders as ZIP archives.
• Streams ZIP content directly to the response without buffering the complete archive in memory.
• Preserves nested and empty directories.
• Excludes .trash directories and skips symbolic links.
• Reuses existing user-root path validation and download rate limiting.
• Sets Content-Type: application/zip and a UTF-8 attachment filename.
• Added endpoint documentation and tests covering normal, nested, empty, trash, traversal, and symlink cases.

Linked issue

Part of #105

How to test

1. Run the backend test suite:

   cd backend
   ./mvnw test

2. Authenticate as a user with files in their root directory.

3. Download a folder:

   GET /api/folders/download?path=photos
   Authorization: Bearer <token>
   

4. Verify that:

   • The response downloads as photos.zip.
   • Nested paths and empty directories are preserved.
   • .trash content is absent.
   • Traversal paths such as ../outside are rejected.
   • Symlinks are not included.

5. Omit path to test downloading the authenticated user’s root folder.

Notes / Risk

• No database migrations or feature flags are required.
• ZIP creation is streamed, so memory use does not grow with the complete archive size.
• Archive generation still consumes filesystem I/O and CPU for the duration of the download.
• Folder downloads use the existing download rate-limit budget.
• Symbolic links are skipped entirely, including links that remain inside the user root.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[DenizAltunkapan]

This is in good shape overall. CI is green, the feature is well tested, .trash is excluded, symlinks are skipped in general, and the new endpoint is correctly wired to the download rate limit. I have one small security hardening request before approving, plus a minor error-handling note.

[arnabnandy7]

This is in good shape overall. CI is green, the feature is well tested, .trash is excluded, symlinks are skipped in general, and the new endpoint is correctly wired to the download rate limit. I have one small security hardening request before approving, plus a minor error-handling note.

I'll do it shortly and let you know.

[DenizAltunkapan]

@arnabnandy7 good work! thank you for your contribution