feat(webapi): expose the core's shared-directory configuration - #531

Follow-up to #530, which made the core's share roots reachable over EC. amuleapi could already list the files a share produced (/shared) and ask the core to re-walk its roots (/shared/reload), but had no way to see or change which roots those were.

Endpoints

GET returns the user's intent, not the runtime expansion: a recursive root is a single entry however many subdirectories it covers. The derived union is deliberately not exposed — it's generated state, not configuration. Read access is GUEST to match GET /shared and GET /preferences, both of which already expose paths.

PUT mirrors the core's operation one-for-one rather than hiding a read-modify-write behind a merge. POST/DELETE exist because the scripted case is a single folder, and making every client read-splice-write the whole list is how clients get it wrong. POST is idempotent (re-adding updates the recursive flag) so "ensure this is shared" repeats safely; DELETE 404s on an unconfigured path so a typo is visible.

Validation

The core validates each path — a REST client can't stat the core's filesystem, so a typo would otherwise become a silently dead share. Entries that pass are applied, persisted and rescanned; the rest come back in rejected, and one bad path never discards the edit:

{ "ok": true, "rejected": [ { "path": "/typo", "reason": "not_found" } ] }

Reasons arrive from the core as codes and are rendered here, so its locale can't leak into a response — the same approach amuleGUI uses.

Concurrency

POST and DELETE are read-modify-write against a whole-list operation, so they hold a mutex across the read and the write: SendRecvSerialized locks per round-trip, not across a pair, and two concurrent adds would otherwise lose one. Nothing can make this atomic against a simultaneous amuleGUI edit — the protocol has no compare-and-set — so that stays last-write-wins, and the reference documents it rather than implying otherwise.

Testing

New 31-shared-directories.sh curl smoke, registered in run-all.sh. It snapshots the operator's real configuration and restores it on exit (including early exit), and works entirely under a mktemp directory. Covers auth/method/body guards, an add → read-back → delete round trip, idempotent re-add, and a server-side rejection landing alongside a valid entry that survives.

30/30 passing against a live amuled + amuleapi. clang-format clean across src/, Tier-1 and Tier-2 clang-tidy clean. No .po impact — the reason strings are wire values, not translatable text.