상위 디렉터리 및 카테고리의 소유권을 검증하지 않던 문제 등 버그 수정 및 Vitest 기반 테스트 추가

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/setup/server.ts

@@ -0,0 +1,20 @@
+import { mkdtemp } from "fs/promises";
+import { tmpdir } from "os";
+import { join } from "path";
+import { vi } from "vitest";
+
+const storagePath = await mkdtemp(join(tmpdir(), "arkvault-test-"));
+
+vi.mock("#lib/server/loadenv.js", async () => {
+  const { inject } = await import("vitest");
+  return {
+    default: {
+      nodeEnv: "test",
+      database: inject("database"),
+      session: { secret: "test-secret", exp: 14 * 24 * 3600 * 1000 },
+      challenge: { userClientExp: 5 * 60 * 1000, sessionUpgradeExp: 5 * 60 * 1000 },
+      libraryPath: join(storagePath, "library"),
+      thumbnailsPath: join(storagePath, "thumbnails"),
+    },
+  };
+});