[_]: fix/add-webdav-rfc-fixes

[larryrider]

This branch fixes a batch of WebDAV RFC 4918 (and RFC 7233 Range-Request) compliance issues found while auditing the CLI's WebDAV server, plus a few unrelated reliability fixes for the Docker deployment.

RFC / protocol compliance fixes:

• LOCK: return 201 Created when locking a not-yet-existing resource (lock-null resource per RFC 4918 9.10.1), 200 OK when locking an existing one, previously always returned 200.
• MOVE: honor the Overwrite header (RFC 4918 10.6). Defaults to T, when F and the destination already exists, respond 412 Precondition Failed instead of silently overwriting. When overwriting is allowed, return 204 (existing destination replaced) vs 201 (new destination created), matching the same replace-vs-create pattern already used in PUT.
• PROPFIND: throw NotFoundError for missing resources instead of manually sending a raw 404, so it goes through the shared error-handling middleware like every other handler.
• OPTIONS / PROPPATCH: advertise PROPPATCH in the Allow header and implement an actual PROPPATCH handler (previously unimplemented), needed by clients (e.g. Synology Hyper Backup) that probe support before writing.
• GET / HEAD: proper Range-Request handling, added RangeNotSatisfiableError (416) and reworked parseRangeHeader to throw BadRequestError (400) for malformed ranges instead of generic errors, and added Content-Range header support on HEAD.
• Error handling middleware: only req.destroy() the connection when the client hasn't finished sending the request body (e.g. a large PUT rejected early by a size check). Trivial errors (404, 409, 415...) now let the response flush normally so keep-alive connections can be reused instead of being reset on every error.
• DELETE / PUT: removed a redundant DriveItemRepository deletion that both handlers were doing unnecessarily.
• PUT: existing files are now always replaced via DriveFileService.replaceFile (in-place metadata update) instead of only when contentLength > 0. For empty/0-byte files (common in WebDAV lock/keep-alive control files written by backup clients like Hyper Backup), the previous delete-then-recreate path raced with backend propagation and could return 409 File already exists on a legitimate overwrite.

Other fixes (not RFC-related, found triaging support tickets on this branch):

• getFolderContent: fetch a folder's subfolders and subfiles concurrently (Promise.all) instead of sequentially, halves the round-trips for large folder listings (e.g. PROPFIND / on accounts with many small backup-generated files).
• Docker session_alive keepalive check: compare the logged-in email case-insensitively. login-legacy normalizes the email to lowercase server-side, so an INXT_USER env var with any uppercase character made the keepalive loop think the session was always expired, forcing a full re-login (and WebDAV server restart) roughly every 30s, even when idle.
• unhandledRejection guard added to both CLI entrypoints (bin/run.js, bin/dev.js), mirroring the existing uncaughtException guard in the WebDAV server. A stream-cleanup race inside @internxt/inxt-js's upload pipeline can reject an orphaned promise with AbortError/ABORT_ERR outside of our own try/catch, previously this crashed the whole process (defeating upload-folder's per-file retry/skip logic), now it's logged and the command keeps going.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
88.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud