feat(backend): add server-side directory browsing API

- Add BrowseDirectories() to library service with path traversal protection
- Add BrowseDirectories handler with proper error handling
- Register GET /api/libraries/browse endpoint (admin-only)
- Returns current path, parent path, and list of subdirectories
- Security: blocks "..", validates path exists, checks is directory

Fixes: Issue 2 (backend)

internal/handlers/library.go

@@ -250,6 +250,25 @@ func (h *LibraryHandler) DeleteLibraryFolder(c echo.Context) error {
 	return c.NoContent(http.StatusNoContent)
 }
 
+// BrowseDirectories returns directory listings for folder browser UI
+func (h *LibraryHandler) BrowseDirectories(c echo.Context) error {
+	path := c.QueryParam("path")
+	if path == "" {
+		path = "/" // Start from root
+	}
+
+	dirs, currentPath, parentPath, err := h.libraryService.BrowseDirectories(c.Request().Context(), path)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
+	}
+
+	return c.JSON(http.StatusOK, map[string]interface{}{
+		"current_path": currentPath,
+		"parent_path":  parentPath,
+		"directories":  dirs,
+	})
+}
+
 // SetLibraryVisibility sets library visibility for a user
 func (h *LibraryHandler) SetLibraryVisibility(c echo.Context) error {
 	user := c.Get("user").(database.Users)