v2.1.3-beta

**Reminder**: consider enabling analytics (it's like steam survey) in admin settings, I will release this dashboard once I have a consistent 100+ reports each week
<img width="1000" alt="image" src="https://github.com/user-attachments/assets/ad924188-ce89-448c-a0dd-7d6974e8b7c7" />

## What's Changed

 **Security**:
 - [Moderate] Passkey registration and deletion now require the account password when a passkey is already configured, and passkeys cannot be altered through generic user profile PATCH (GHSA-r744-4vm3-2px3) reporter @tonghuaroot
 - [Medium] Storage quota accounting now records upload byte deltas using the pre-replace file size, and upload paths without size metadata or with resumed chunk offsets cannot skip quota checks (GHSA-m57f-66qj-8jxg) reporter @jayhemnani9910
 - [High] Sources marked `readOnly` are now enforced on WebDAV writes, server-side archive/unarchive, and OnlyOffice save callbacks (GHSA-4v62-884x-2466) reporter @anpryl
 - [Moderate] Moving or renaming a folder updates only shares whose paths are under the moved prefix, preserving per-file share roots instead of retargeting unrelated substring matches (GHSA-26fh-r34c-qxh6) reporters @jayhemnani9910 @dylanzonix
 - [Moderate] WebDAV PUT now requires Create permission when the target path does not yet exist, so Modify-only users cannot create new files (GHSA-8655-2ph3-q7q7) reporter @levanduy181
 - [Low] Failed-login lockout and auth rate limits now use the rightmost `X-Forwarded-For` hop when proxy headers are trusted, so a client cannot spoof the client IP with a leftmost forwarded value (GHSA-wjp8-g49g-xrhx) reporter @LECOQQ
 - [Low] Duplicate finder results are cached per requesting user so filtered file names from one account are not served to another (GHSA-4fhx-8pf6-5gmr) reporter @Nazarami
 - [Moderate] Authenticated `GET /api/resources/view` no longer accepts view tokens minted for a public share when the caller lacks view permission on the requested source (GHSA-wxj5-g3qp-g732) reporter @BlueN0r
 - [Moderate] SSE source-update and user-targeted delivery hold the client registry lock through nonblocking sends, preventing concurrent map mutation and send-on-closed-channel panics when Realtime clients connect, disconnect, or shut down (GHSA-p9wm-f5jj-75pj) reporter @tao0845
 - [High] Incomplete symlink-containment remediation: an authenticated non-admin user could create a relative symlink via archive extraction, relocate it with WebDAV MOVE, and write through it to arbitrary host paths with the service account's privileges (GHSA-3j46-5w28-f8p2) reporters @Saku0512 @HuzaifaDal
 - [Moderate] Source-root containment bypass: create, write, delete, and move operations now resolve symlinks uncached and enforce the caller's scope, closing escapes through pre-existing out-of-source symlinks on upload, PUT, PATCH, delete, and WebDAV endpoints (GHSA-j764-qg3m-rhv7) reporter @chaoming0625
 - [Moderate] Preview reads resolve symlinks within the caller's scope so authenticated preview cannot follow an out-of-scope symlink target (GHSA-g2q5-r6ch-v25f) reporters @tao0845 @Ly0nt4r
 - [Moderate] Archive downloads and extraction no longer read or write through symlinks that resolve outside the caller's share or user scope; escaping archive-walk entries are skipped (GHSA-qqf3-2wvq-q4w9) reporter @SmokinCaterpillar
 - [Moderate] Share directory-archive downloads now apply the share owner's access rules to every entry, closing a bypass where anonymous share visitors could download admin-denied content (GHSA-9fcr-gm58-p839) reporter @Tan-JunWei
 - [Moderate] Access rule paths are stored and matched case-insensitively so rules cannot be bypassed via path casing on case-insensitive filesystems; existing rules are migrated at startup (GHSA-4vrc-935w-xxq2) reporter @FrogApprentice
 - [High] Stored XSS in the File Size Analyzer tooltip via unescaped `v-html` with a nonce-CSP bypass through an allowlisted CDN; Tooltip, Generic, and OfficeDebug prompts no longer render HTML (GHSA-rmjp-pfrq-cc3v) (#3199) reporter @U3RhcnQ thanks @Kurami32
 - [Medium] Unarchive extraction could write into folders denied by access rules and overwrite files without modify permission; extraction now enforces access rules and modify permission on every entry (GHSA-p93p-v944-4p44) (#3203) reporter @jayhemnani9910

 **New Features**:
 - chunked uploads for large files like rclone `--owncloud-chunk-size` (#3112) @paoValle
 - File tree sorting is now alphabetical with pinned indicators (#3154) @Kurami32

 **Notes**:
 - Markdown math rendering now uses Temml (MathML) instead of KaTeX; frontend and backend dependencies updated (#3241)
 - WebDAV upload handling hardening (#3151)
 - Listing highlight now follows the item shown by next/previous navigation (#3156) @Kurami32
 - Updated frontend dependencies (#3228) @Kurami32
 - Dev: fixed vite warnings and dev-server origin restriction (#3155) @Kurami32, updated linting and tests on macOS (#3231), fixed markdown screenshot tests (#3171)

 **Bug Fixes**:
 - keep requested permissions when creating a user (#3130) @jayhemnani9910, including partial global permissions on API create (#3165) (#3171)
 - add missing file modify logging to activity viewer (#3152), including uploads and deletes made through a share (#3166) @jayhemnani9910
 - fix(frontend): restore upload prompt close, tab-reload, and in-app navigation guards while uploads are active (including paused uploads) (#3220) (#3222)
 - fix(frontend): load the default source when browsing `/files/` with a single configured source (#3215) ([#3178](https://github.com/gtsteffaniak/filebrowser/issues/3178)) (related: [#3143](https://github.com/gtsteffaniak/filebrowser/issues/3143), [#3144](https://github.com/gtsteffaniak/filebrowser/issues/3144))
 - Path picker list and thumbnails not working in shares in the markdown editor (#3223) @Kurami32.
 - perf(indexing): single statx per Linux directory entry (#3230) (#1890)
 - fix(indexing): resume the persisted scan schedule on startup (#3225) @paoValle
 - fix(webdav): free the deleted bytes from the quota counters (#3160) @paoValle
 - fix: upload session not released after a successful single-file upload (#3186) @anonymous-writer
 - fix: preserve file permissions when saving edits (#3159) @oodadoudou
 - fix(auth): preserve admin source scope with createUserDir (#3125) @SomSamantray
 - fix(settings): don't panic when config has no server map (#3176) @HawkForge
 - fix(frontend): hide write actions in read-only sources (#3149) @anpryl
 - fix(frontend): hide activity, quota, and access buttons in the Info prompt inside shares (#3224) @Kurami32
 - fix(share): honor userDefaults singleClick for anonymous shares (#3147) @vulragrag-star
 - fix(markdown): missing creation time and tiny font on markdown viewer code blocks (#3157) @Kurami32
 - assorted CodeRabbit review findings on the v2.1.3 beta (#3240)

**Full Changelog**: https://github.com/gtsteffaniak/filebrowser/compare/v2.1.2-beta...v2.1.3-beta