feat: improve multi-user permission controls

chfs-ng/internal/api/user_management_test.go

@@ -96,8 +96,8 @@ func TestUserManagementAndPrivateHome(t *testing.T) {
 
 	// Re-enable and grant read-only access to a shared directory.
 	rules := []map[string]any{
-		{"dir": "users/alice", "mask": "rwd"},
 		{"dir": "public", "mask": "r"},
+		{"dir": "public/private", "mask": "r", "deny": true, "childrenOnly": true},
 	}
 	updateBody, _ = json.Marshal(map[string]any{"username": "alice", "enabled": true, "rules": rules})
 	req = httptest.NewRequest(http.MethodPut, "/chfs/users", bytes.NewReader(updateBody))
@@ -114,6 +114,12 @@ func TestUserManagementAndPrivateHome(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(root, "public", "readme.txt"), []byte("ok"), 0644); err != nil {
 		t.Fatal(err)
 	}
+	if got := mgr.Accounts["alice"].MaskFor("users/alice"); got != auth.Read|auth.Write|auth.Delete {
+		t.Fatalf("home permission was not preserved: %v", got)
+	}
+	if got := mgr.Accounts["alice"].MaskFor("public/private/file.txt"); got != auth.None {
+		t.Fatalf("deny rule was not applied: %v", got)
+	}
 	token, err = auth.NewToken("alice", 30)
 	if err != nil {
 		t.Fatal(err)