Add a files browser for every folder on the data volume

A bot's deliverables and the raw material behind them only existed as
paths in a message, so they couldn't be opened from the app at all. This
browses them read-only at /admin/files, one volume at a time: a bot's own
folder, a workspace's shared one, a computer's home (where a bot's ~/...
actually is), the media library, an MCP server's install folder and the
database.

Access is the whole gate: resolveStorageSpec checks the viewer against
the volume first (a bot through grabUserBot, a workspace through
grabUserWorkspace, a computer through grabUserComputer, media only their
own unless they manage the crew) and no path is built before it passes.
resolveStoragePath then applies the resolveBotPath rules to any root.
The picker lists folders through reachableBotsSql, so it never offers one
the resolver would refuse.

Reading is listStorageEntries (folders first, paginated, symlinks
skipped, catalog rows joined so a bot file still opens through its media
row) and grabStorageFile for bytes under a cap, both behind an ETag.

src/schemas/storage-schema.ts

@@ -0,0 +1,41 @@
+import { z } from "zod";
+import { AppData } from "@/src/data/app-data";
+import { StorageVolumeDefs } from "@/src/utils/storage-volumes";
+
+const VolumeField = z.enum(
+    StorageVolumeDefs.map((def) => def.value) as [
+        (typeof StorageVolumeDefs)[number]["value"],
+        ...((typeof StorageVolumeDefs)[number]["value"])[],
+    ],
+);
+
+/**
+ * The volume and owner a storage request asks for. The owner is left out
+ * for the database, which has one folder.
+ */
+const StorageTargetFields = {
+    volume: VolumeField,
+    owner: z.coerce.number().int().nonnegative().default(0),
+};
+
+/**
+ * `GET api/admin/storage/list`: one folder on the data volume.
+ */
+export const StorageListRequestSchema = z.object({
+    ...StorageTargetFields,
+    path: z.string().max(AppData.BotFilePathMaxChars).optional(),
+    search: z.string().max(120).optional(),
+    offset: z.coerce.number().int().nonnegative().default(0),
+});
+
+export type StorageListRequest = z.infer<typeof StorageListRequestSchema>;
+
+/**
+ * `GET api/admin/storage/file`: one file's bytes.
+ */
+export const StorageFileRequestSchema = z.object({
+    ...StorageTargetFields,
+    path: z.string().min(1, "Pick a file").max(AppData.BotFilePathMaxChars),
+});
+
+export type StorageFileRequest = z.infer<typeof StorageFileRequestSchema>;