#9527 fix(files): authorize the workspace before resolving a files/ path

Summary

• #9504 resolved a files/… VFS path inside the caller-asserted workspace before any authorization. The not-found case was concealed, but the "names more than one file whose names display alike" error was thrown pre-authorization, so a non-member who knew a workspace id could learn that look-alike names exist at a path
• defineAuthorizedWorkspaceFileUseCase now runs authorizeWorkspaceFileVfsPath first for path inputs: path syntax is still checked without touching the DB (a malformed path stays a validation error for everyone), then the asserted workspace is loaded and authorized with the operation's own minimum role — the same check the id path runs — and only then is the name looked up
• Authorized members see identical results; id inputs are unchanged. A member below the operation's role now gets forbidden before the lookup (normal authorize-first order; v2 conceals it the same way)

Type of Change

• Bug fix

Testing

• file-path-references.integration.ts: a non-member gets the same outcome for an ambiguous, a missing and an existing path, and a dot-segment path is still a validation error. Ran locally against real Postgres: 10/10 with the fix; the new case fails on the pre-fix code
• rename-workspace-file.test.ts, read-workspace-file-metadata.test.ts; biome; full gate in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)