fix: hide denied entries in CHFS listings

chfs-ng/internal/api/server.go

@@ -168,7 +168,9 @@ func (s *Server) files(w http.ResponseWriter, r *http.Request) {
 	p := qpath(r)
 	m := a.MaskFor(p)
 	if !m.HasRead() {
-		http.Error(w, "forbidden", 403)
+		// CHFS keeps the files endpoint HTTP-successful for a denied directory
+		// and returns an empty listing with currentMask="".
+		writeJSON(w, map[string]any{"files": []fileInfo{}, "currentMask": "", "virtualRoot": false})
 		return
 	}
 	list, e := s.Store.List(p)
@@ -179,6 +181,11 @@ func (s *Server) files(w http.ResponseWriter, r *http.Request) {
 	out := make([]fileInfo, 0, len(list))
 	for _, fi := range list {
 		fp := path.Join(p, fi.Name())
+		// A rule.none entry is not merely read-less metadata: CHFS hides the
+		// entry from directory listings because the directory itself is denied.
+		if !a.MaskForEntry(fp).HasRead() {
+			continue
+		}
 		sub := false
 		if fi.IsDir() {
 			if xs, e := s.Store.List(fp); e == nil {