feat: implement comprehensive access control system

- Add authorizedGet function for secure resource access
- Implement ownership verification for all file/directory operations
- Use security through obscurity (not found vs access denied)
- Optimize bulk operations by removing redundant authorization checks
- Move generateFileUrl to filesystem.ts as fetchFileUrl with proper auth
- Ensure all database access goes through authorization layer

Co-authored-by: Ona <no-reply@ona.com>

packages/convex/model/files.ts

@@ -1,5 +1,5 @@
 import type { Doc, Id } from "../_generated/dataModel"
-import type { AuthenticatedMutationCtx } from "../functions"
+import { type AuthenticatedMutationCtx, authorizedGet } from "../functions"
 import * as Err from "./error"
 import type { DirectoryHandle, FileHandle } from "./filesystem"
 
@@ -48,7 +48,7 @@ export async function move(
 ) {
 	const conflictCheckResults = await Promise.allSettled(
 		items.map((fileHandle) =>
-			ctx.db.get(fileHandle.id).then((f) => {
+			authorizedGet(ctx, fileHandle.id).then((f) => {
 				if (!f) {
 					throw Err.create(
 						Err.Code.FileNotFound,