[devld]

Recursive deletion could remove protected descendants, and write operations could select a different destination after permission checks. This change checks recursive permissions correctly and authorizes the final virtual write target before storage changes.

• Intersect independently resolved effective permissions across subtree rules, preserving inheritance and user/group precedence.
• Add read-only PrepareWrite destination selection shared by save, upload, copy, and move. Check final-path and missing-parent permissions while preserving mount and chroot namespaces.
• Remove automatic renaming from execution. File-manager copy/move and initial upload requests prepare names first; execution and upload callbacks retain exact targets and reject non-overwrite conflicts.
• Delegate WebDAV COPY/MOVE to complete drive operations. Permission-rejected replacement moves preserve existing destinations; recursive copies reject unreadable subtrees. Depth: 0 checks the source directory itself and any destination subtree being replaced.
• Make directory-copy fallback replace stale destination contents and propagate native S3/WebDAV conflicts. Local non-overwrite saves use exclusive creation.

Compatibility: direct execution callers requiring automatic naming must call preparation first. Non-overwrite conflicts are errors rather than skipped entries or implicit renames. Directory-copy overwrite fallback replaces the target rather than merging stale contents. Preparation does not reserve names; atomic conflict handling remains backend-dependent, and storage failures/cancellation do not gain transactional rollback.

Validation:

• go test ./... passed with localhost binding permitted for HTTP integration tests.
• go test -race ./drive ./drive/fs ./server/webdav ./common/driveutil passed.
• Added real filesystem/Dispatcher/WebDAV regressions for the review findings, renamed write authorization, missing parents, mount/chroot paths, upload provider issuance/callbacks, late conflicts, Depth: 0, and replacement behavior.
• Native S3 and remote WebDAV conflict regressions passed against local HTTP fixtures.
• Documentation build and translation validation passed from docs/site; git diff --check passed.