fix: require delete permission for WebDAV overwrite

chfs-ng/internal/api/server.go

@@ -1372,9 +1372,9 @@ func (f *webdavAuthFS) Create(ctx context.Context, name string, body io.ReadClos
 		return nil, false, err
 	}
 	// CHFS permits PUT to overwrite an existing file only when the target
-	// itself is writable. A writable parent alone is enough for creation.
+	// itself is deletable. A writable parent alone is enough for creation.
 	if _, err := f.inner.Stat(ctx, name); err == nil {
-		if err := f.allow(name, auth.Write); err != nil {
+		if err := f.allow(name, auth.Delete); err != nil {
 			return nil, false, err
 		}
 	} else if !os.IsNotExist(err) {