Require POST for file web mutations

[lustsazeus-lab]

Summary

• Require POST for the browser file manager's /upload, /mkdir, and /delete mutation endpoints.
• Return 405 Method Not Allowed with Allow: POST for non-POST mutation requests.
• Add a regression test that proves authenticated GET requests cannot upload, create folders, or delete files.

Fixes #81.

Root Cause

The handlers for file-manager mutations resolved the logged-in session and read form/query values without first checking the HTTP method. That allowed an authenticated GET such as /delete?path=/me/keep.txt to execute the delete path and redirect.

Validation

• go test ./internal/files -run TestWebMutationsRejectGet -count=1
• go test ./...
• go build ./...
• go vet ./...