fix(dav): bulk upload part validation and path-based file reload

[joshtrichards]

• Resolves: #

Summary

Harden the DAV bulk-upload endpoint when processing multipart file parts.

• Validate required X-File-Path and non-negative numeric Content-Length headers.
• Preserve support for zero-byte files.
• Reload uploaded files by their requested path after setting mtime, instead of resolving by file ID.
• Ensure per-part error handling reports the captured path safely.
• Add regression coverage for malformed headers and failed path reloads.

Why

getFirstNodeById() can return null and does not guarantee which accessible node is selected when a file is reachable through multiple mounts. Reloading by the uploaded path is deterministic and avoids dereferencing a nullable result.

Malformed multipart headers were also able to reach later upload handling code instead of being rejected during parsing.

Testing

• Added parser tests for missing X-File-Path and invalid Content-Length values.
• Added coverage that Content-Length: 0 remains accepted.
• Added plugin coverage for a failed path-based reload and verified that getFirstNodeById() is not used.

TODO

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI