feat(backend): add server-side directory browsing API

- Add BrowseDirectories() to library service with path traversal protection
- Add BrowseDirectories handler with proper error handling
- Register GET /api/libraries/browse endpoint (admin-only)
- Returns current path, parent path, and list of subdirectories
- Security: blocks "..", validates path exists, checks is directory

Fixes: Issue 2 (backend)

internal/router/library.go

@@ -28,6 +28,7 @@ func registerLibraryRoutes(cfg *Config) {
 	adminLibrary := library.Group("", handlers.AdminMiddleware)
 	adminLibrary.POST("", cfg.LibraryHandler.CreateLibrary)
 	adminLibrary.GET("", cfg.LibraryHandler.ListLibraries)
+	adminLibrary.GET("/browse", cfg.LibraryHandler.BrowseDirectories)
 	adminLibrary.GET("/:id", cfg.LibraryHandler.GetLibrary)
 	adminLibrary.PUT("/:id", cfg.LibraryHandler.UpdateLibrary)
 	adminLibrary.DELETE("/:id", cfg.LibraryHandler.DeleteLibrary)