soulseek: scope cached folder reads to their peer

Probing the live routes turned up that /browse/<peer>/dirs/<id>/files only checked
the owner, not the peer: dir ids are global, so asking for one peer's folder id
under a different peer's name returned the other peer's files with a 200. The UI
always sends a matching pair so nothing misbehaved, but the URL was asserting a
relationship the query never verified — a mismatched or stale request would show
the wrong peer's contents rather than a 404.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/sidecar/slskd/officer.ts

@@ -127,7 +127,7 @@ async function handleBrowse({ req, url, userId, segments }: BrowseRouteParams):
     if (req.method !== 'GET') return methodNotAllowed();
     const dirId = Number(segments[3]);
     if (!Number.isInteger(dirId) || dirId <= 0) return badRequest('invalid directory id');
-    const files = await getSoulseekBrowseDirFiles(userId, dirId);
+    const files = await getSoulseekBrowseDirFiles({ userId, username, dirId });
     return files ? Response.json(files) : notFound();
   }