feat: implement comprehensive access control system

- Add authorizedGet function for secure resource access
- Implement ownership verification for all file/directory operations
- Use security through obscurity (not found vs access denied)
- Optimize bulk operations by removing redundant authorization checks
- Move generateFileUrl to filesystem.ts as fetchFileUrl with proper auth
- Ensure all database access goes through authorization layer

Co-authored-by: Ona <no-reply@ona.com>

packages/web/src/files/image-preview-dialog.tsx

@@ -41,8 +41,8 @@ export function ImagePreviewDialog({
 	file: Doc<"files">
 	onClose: () => void
 }) {
-	const fileUrl = useConvexQuery(api.files.generateFileUrl, {
-		storageId: file.storageId,
+	const fileUrl = useConvexQuery(api.filesystem.fetchFileUrl, {
+		fileId: file._id,
 	})
 	const setZoomLevel = useSetAtom(zoomLevelAtom)