feat(acl): tree-based access editor + permission-aware UI

Admin — Access Control is now a folder/file tree. Pick a user/group, click a
node to set an allow and/or deny rule there; each node shows the subject's
*effective* rights (letters S V R E C D M) and allow/deny "set here" badges,
computed server-side incl. group membership, inherited folder rules and
deny-wins. New queries: myAccess(paths) and subjectAccess(subjectType,subjectId,paths).

Main UI — actions are hidden when the current (non-admin) user lacks the
permission: create folder/document (Sidebar), drag-to-move, and Save/Delete in
the document view. Adds a permission-gated Delete button to the document
toolbar. Admins bypass and see everything.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/internal/db/db.go

@@ -691,6 +691,20 @@ func (d *DB) EffectiveAccess(username string, groupNames []string, path string)
 	}
 }
 
+// UsernameByID returns the username for a user id, or "" if not found.
+func (d *DB) UsernameByID(id int64) string {
+	var n string
+	d.sql.QueryRow(`SELECT username FROM users WHERE id=?`, id).Scan(&n)
+	return n
+}
+
+// GroupNameByID returns the group name for a group id, or "" if not found.
+func (d *DB) GroupNameByID(id int64) string {
+	var n string
+	d.sql.QueryRow(`SELECT name FROM groups WHERE id=?`, id).Scan(&n)
+	return n
+}
+
 func (d *DB) userID(username string) (int64, bool) {
 	var id int64
 	err := d.sql.QueryRow(`SELECT id FROM users WHERE username=?`, username).Scan(&id)