fix(auth): migrate user base paths to scoped roles

[okatu-loli]

Users whose base path matches a role scope can resolve a selected path twice (for example, /教学 becomes /教学/教学). Keep user base paths at / and migrate existing non-root restrictions into roles so upgrading does not broaden their directory scope.

Changes

• Normalize creation, editing, and SSO/LDAP registration to /; retire default-directory settings in favor of role scopes.
• Transactionally create and bind per-user roles using the intersection of the old base path and existing role scopes. Preserve permission bits, credentials and account state. Users already rooted at / do not get per-user roles; ordinary shared roles remain unchanged.
• Preserve admin/guest identity. When guest grants must be split, root guest users reuse one shared template, and default registration settings retain their prior grants.
• Propagate migration failures and record the launch version only after successful upgrades. Cover rollback/retry and repeated startup.
• Keep root browsing from inheriting child operation permissions, retain scoped FTP/SFTP login, filter protocol directory listings, and check copy/move destination scope.
• Avoid decoding download and WebDAV URL paths twice.

Validation

• Related bootstrap, op, fs, common, handlers, middleware, FTP and WebDAV tests passed, including -race, plus command-package tests and application build.
• Isolated-process SQLite migration failure/retry/restart checks passed: no partial users or roles, no version advance on failure, successful retry, no duplicate roles on restart.
• Live HTTP/WebDAV/FTP/SFTP checks passed: scoped access, root-user preservation, guest access, directory passwords, signed special-character downloads, scoped writes, filtered root listings and rejected out-of-scope operations.
• Full go test ./internal/... ./server/... ./cmd/... has three failures also reproduced on unmodified upstream e1c022a9: TestSecureJoin/drive on macOS, TestDownloadOrder, and the existing server/s3/backend.go:331 log-format vet error.

Compatibility

Clients must use full virtual paths after upgrading. Existing SSO/LDAP default-directory isolation becomes role-based. Coordinate release with the companion frontend PR: AlistGo/alist-web#311. Live protocol checks used local storage; external identity providers and all remote drivers were not exercised.