feat(sidebar): scan a single folder from the folder context menu (#1108)

The Refresh menu can scope a scan to one model root, but the folder a user is
looking at lives in the sidebar's unified tree, which merges every root into one
relative-path namespace. "Scan this folder" therefore addresses the folder, not a
root: the backend walks that relative path under every root that holds it, which
is also what makes the action safe while another drive is switched off.

Backend:
* GET /scan accepts `folder=<rel>` (alone or with `roots=`), rejected together
  with full_rebuild=true like the roots parameter. Validation reuses
  normalize_relative_folder(), extracted to module scope from ModelMoveService so
  the folder operations and the scan endpoint reject the same input (absolute
  paths, drive letters, `..` climbing) instead of each carrying its own copy.
* The reconcile summary carries `scope_label` (the folder) for a folder scope, so
  the result toast names the folder the user clicked instead of the roots it
  happens to live under; the completed WS payload carries it too.
* `folder` is a scope prefix exactly like a root: only that subtree is re-read or
  pruned, and an unreachable root keeps the entries that fall inside it.

Frontend:
* The sidebar folder context menu gains "Scan this folder" above "Check for
  updates in this folder" (they share the refresh divider); the entry is gated by
  the same supportsFolderManagement flag as the other folder operations.
* SidebarManager.scanFolder() resolves the node through the existing
  _resolveFolderCandidates() before doing anything: a folder no root holds any
  more explains itself ("no longer exists on disk") instead of scanning nothing,
  and an unresolvable multi-root node is refused rather than guessed.
* PageControls.refreshModels() and BaseModelApi.refreshModels() forward the folder
  scope, and _showRefreshSummary() prefers scope_label over the walked roots.

Verified live on the three-root sandbox with one drive switched off:
GET /scan?folder=pack000 walks drive-G and drive-Y, reports scope_label=pack000,
keeps drive-Z's 6 entries under that folder (kept_unreachable=6) and leaves all
420 models cached. 3704 passed, 7 skipped; frontend 1495 passed (150 files); vue
widgets 96 passed. The 2 new sidebar keys are [TODO: Translate] placeholders
pending the feature owner's go-ahead.

static/js/api/baseModelApi.js

@@ -511,9 +511,10 @@ export class BaseModelApiClient {
         }
     }
 
-    async refreshModels(fullRebuild = false, { roots = null } = {}) {
+    async refreshModels(fullRebuild = false, { roots = null, folder = null } = {}) {
         const abortController = new AbortController();
         const scopeRoots = Array.isArray(roots) ? roots.filter(Boolean) : [];
+        const scopeFolder = typeof folder === 'string' && folder ? folder : null;
         const displayName = this.apiConfig.config.displayName;
         const singularName = this.apiConfig.config.singularName;
         const actionText = translate(
@@ -604,6 +605,9 @@ export class BaseModelApiClient {
             for (const root of scopeRoots) {
                 url.searchParams.append('roots', root);
             }
+            if (scopeFolder) {
+                url.searchParams.append('folder', scopeFolder);
+            }
 
             const response = await fetch(url, { signal: abortController.signal });
 
@@ -619,7 +623,7 @@ export class BaseModelApiClient {
 
             resetAndReload(true);
 
-            this._showRefreshSummary(data, actionText, scopeRoots);
+            this._showRefreshSummary(data, actionText, scopeRoots, scopeFolder);
         } catch (error) {
             if (error.name === 'AbortError') {
                 showToast('toast.api.operationCancelled', {}, 'info');
@@ -646,12 +650,15 @@ export class BaseModelApiClient {
      * @param {string} actionText - Localized "Refresh" / "Full rebuild"
      * @param {Array<string>} scopeRoots - Roots the scan was restricted to
      */
-    _showRefreshSummary(summary, actionText, scopeRoots = []) {
+    _showRefreshSummary(summary, actionText, scopeRoots = [], scopeFolder = null) {
         const payload = summary || {};
         const scannedRoots = Array.isArray(payload.scanned_roots) ? payload.scanned_roots : [];
-        const scopeLabel = scannedRoots.length ? scannedRoots.join(', ') : '';
+        // A folder scan is named by the folder the user clicked; a root scan by
+        // the roots it walked.
+        const scopeLabel = payload.scope_label
+            || (scannedRoots.length ? scannedRoots.join(', ') : '');
 
-        if (scopeRoots.length && scopeLabel) {
+        if ((scopeRoots.length || scopeFolder) && scopeLabel) {
             showToast(
                 'toast.api.refreshCompleteScoped',
                 {