fix: bind per-session state to the requesting user in multi-user mode

[EllaFr]

In multi-user mode the file endpoints isolate users through UserFS, but per-session working-directory state isn't namespaced the same way. _session_cwds is keyed by X-Session-Id alone with no owner, so the same entry is addressed regardless of who sends the request, POST /files/cwd writes to whatever session id the request names, and its target validation is skipped whenever multi-user mode is active. get_filesystem also falls back to an unscoped UserFS when X-User-Id is absent, which skips per-user path validation entirely.

Key _session_cwds by (user, session id), taking the user from the server-derived X-User-Id the Open WebUI proxy already sends, so a reused session id resolves within the caller's own namespace rather than reaching another user's state. X-User-Id is now required when multi-user mode is enabled instead of silently falling back to an unscoped filesystem, and the POST /files/cwd target is validated in all modes through UserFS.isdir rather than in single-user mode only. Single-user mode is unchanged.

Contributor License Agreement

• By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

Note

Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.

[maurerle]

This fixes three issues in the usage of the X-Session-Id vs X-User-Id and therefore improves security.

• Session Isolation: Namespacing _session_cwds by (fs.home, session_id) cleanly prevents cross-user session collisions and IDOR risks.
• Security Boundary: Enforcing the X-User-Id header when multi-user mode is active closes the unauthenticated fallback bypass.
• Directory Validation: Enabling fs.isdir validation unconditionally in set_cwd ensures consistent boundary and existence checks across all modes.