fix(file): trust local workspace roots for fs routes

[kaizhou-lab]

Summary

• keep /api/fs/list on the root-based local contract and trust the requested workspace root for listing
• allow request-scoped workspace/source roots for fs dir/write/copy/remove/rename/zip routes so custom workspaces and external disks work
• add API, service, and E2E coverage for non-sandbox roots plus boundary checks when an explicit root is supplied

Test Plan

• cargo fmt --all -- --check
• cargo test -p aionui-api-types
• cargo test -p aionui-file
• cargo test -p aionui-app --test file_e2e
• cargo clippy -p aionui-api-types -p aionui-file -p aionui-app -- -D warnings

Note: pushed directly with git push --force-with-lease; did not run just push per request.