refactor(server): brand TxDb, inject Clock, extract FoldersService

[allisson]

• TxDb branded type (db/tx.ts) + asTx() — every write-path service signature and the quota advisory-lock helpers now require TxDb, making accidental calls on app.db a compile error. Closes a latent gap where pg_advisory_xact_lock would silently no-op without a surrounding transaction.
• app.clock decorator (plugins/clock.ts) owns every time-sensitive read: session expiry, TOTP windows, recovery token expiry, auth idle check, cleanup interval. Tests use fixedClock/advanceableClock instead of spying on Date.now, which never saw the V8-internal clock new Date() uses.
• FoldersService extracted from inline route logic, mirroring items/trash/shares shape; folder writes now run inside db.transaction(...).
• requireOwner/requireWriter/requireReader on vaults/access.ts consolidate the role-gate pattern duplicated across services.
• Drop duplicate PG 23505 try/catch in register and create-share; global error handler is the single mapping point.