fix(samba): register /api/sharing/ on the mux, not the web switch

The /api/ subtree is routed on the main mux, so the browse case in the web
ServeHTTP switch was shadowed by the apiRouter catch-all and 401'd. Moved to
ServeSharingAPI behind RequireAuth+CsrfProtect, matching /api/storage/.
Found by live validation.

controller/internal/web/server.go

@@ -367,8 +367,6 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		s.sharingShareDeleteHandler(w, r)
 	case path == "/sharing/shares/offsite" && r.Method == http.MethodPost:
 		s.sharingShareOffsiteHandler(w, r)
-	case path == "/api/sharing/browse" && r.Method == http.MethodGet:
-		s.sharingBrowseHandler(w, r)
 	case path == "/settings/notifications" && r.Method == http.MethodGet:
 		s.settingsNotificationsPageHandler(w, r)
 	case path == "/settings/security" && r.Method == http.MethodGet:

controller/internal/web/sharing_handlers.go

@@ -294,6 +294,18 @@ func (s *Server) sharingShareOffsiteHandler(w http.ResponseWriter, r *http.Reque
 	sharingRedirect(w, r, "Beállítás mentve.")
 }
 
+// ServeSharingAPI dispatches the /api/sharing/* XHR endpoints. Registered on the mux in main.go
+// behind RequireAuth+CsrfProtect (the /api/ subtree is claimed there, NOT in the web ServeHTTP
+// switch — a case added there would be shadowed by the apiRouter catch-all and 401).
+func (s *Server) ServeSharingAPI(w http.ResponseWriter, r *http.Request) {
+	switch {
+	case r.URL.Path == "/api/sharing/browse" && r.Method == http.MethodGet:
+		s.sharingBrowseHandler(w, r)
+	default:
+		http.NotFound(w, r)
+	}
+}
+
 // sharingBrowseHandler is the folder picker (GET /api/sharing/browse?path=). With no path it lists
 // the registered live storage roots; otherwise the sub-DIRECTORIES of a guard-approved path, sorted.
 // Deny-listed children are omitted so the picker never offers an unshareable folder.