상위 디렉터리 및 카테고리의 소유권을 검증하지 않던 문제 등 버그 수정 및 Vitest 기반 테스트 추가

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/routes/api/file/[id]/[[thumbnail=thumbnail]]/download/+server.ts

@@ -17,19 +17,19 @@ const downloadHandler = async (locals: App.Locals, params: RouteParams, request:
   const { id } = zodRes.data;
 
   const getStream = params.thumbnail ? getFileThumbnailStream : getFileStream;
-  const { encContentStream, range } = await getStream(
+  const { encContentStream, range, isRangeRequest } = await getStream(
     userId,
     id,
     parseRangeHeader(request.headers.get("Range")),
   );
   return {
     stream: encContentStream,
-    status: range ? 206 : 200,
+    status: isRangeRequest ? 206 : 200,
     headers: {
       "Accept-Ranges": "bytes",
       "Content-Length": String(range.end - range.start + 1),
       "Content-Type": "application/octet-stream",
-      ...getContentRangeHeader(range),
+      ...(isRangeRequest ? getContentRangeHeader(range) : {}),
     },
   };
 };