feat(sidebar): delete folders from the sidebar (#999)

Folders created from the sidebar had no in-app way back out: the only
removal path was to leave ComfyUI, delete the directory by hand and
rescan. A typo'd folder also polluted the move/download destination
picker permanently, since it reads the same all_folders source.

Adds POST /api/lm/{prefix}/delete-folder, restricted to directories
whose subtree holds no model weight files — a folder-level cascade would
bypass the per-model lifecycle bookkeeping (metadata sidecars, previews,
cache entries, pending-delete staging, recipe references). The service
walks the directory itself instead of trusting the possibly stale cache,
reports what it would remove (models / files / subfolders / symlinks),
and refuses library roots, top-level symlinks (shutil.rmtree rejects
those) and folders holding a staged delete, whose manifest would be
invalidated by the move. Symbolic links inside the subtree are counted
but never followed.

ModelScanner.remove_known_folder mirrors add_known_folder: the removed
subtree leaves all_folders while ancestors are kept (every recorded
ancestor exists on disk in its own right), stale cache entries under the
prefix are purged and the folder list recomputed. The handler broadcasts
models_changed so destination pickers drop the folder too.

The sidebar entry is a destructive context-menu item. The modal opens in
a confirm state for model-free folders and an explanatory one when the
subtree still holds models, decided from the models-only set that already
dims empty nodes; a stale tree is caught by the 409 not_empty/busy
conflict. Truly empty folders get the existing 20s undo affordance,
implemented by re-creating the directory.

tests/routes/test_model_move_handler.py

@@ -10,11 +10,17 @@ class FakeMoveService:
     def __init__(self, result):
         self._result = result
         self.received_path = None
+        self.received_dry_run = None
 
     async def create_folder(self, folder_path):
         self.received_path = folder_path
         return self._result
 
+    async def delete_folder(self, folder_path, dry_run=False):
+        self.received_path = folder_path
+        self.received_dry_run = dry_run
+        return self._result
+
 
 class FakeRequest:
     def __init__(self, payload):
@@ -91,3 +97,118 @@ async def test_create_folder_invalid_json_body():
     assert response.status == 400
     payload = json.loads(response.text)
     assert payload["success"] is False
+
+
+@pytest.mark.asyncio
+async def test_delete_folder_success():
+    handler, service = _make_handler(
+        {
+            "success": True,
+            "folder": "characters/anime",
+            "model_count": 0,
+            "restorable": True,
+        }
+    )
+
+    response = await handler.delete_folder(
+        FakeRequest({"folder_path": "/library/characters/anime"})
+    )
+
+    assert response.status == 200
+    payload = json.loads(response.text)
+    assert payload["success"] is True
+    assert payload["restorable"] is True
+    assert service.received_path == "/library/characters/anime"
+    assert service.received_dry_run is False
+
+
+@pytest.mark.asyncio
+async def test_delete_folder_forwards_dry_run():
+    handler, service = _make_handler({"success": True, "dry_run": True})
+
+    response = await handler.delete_folder(
+        FakeRequest({"folder_path": "/library/empty", "dry_run": True})
+    )
+
+    assert response.status == 200
+    assert service.received_dry_run is True
+    assert json.loads(response.text)["dry_run"] is True
+
+
+@pytest.mark.asyncio
+async def test_delete_folder_missing_path():
+    handler, service = _make_handler({"success": True})
+
+    response = await handler.delete_folder(FakeRequest({}))
+
+    assert response.status == 400
+    payload = json.loads(response.text)
+    assert payload["success"] is False
+    assert service.received_path is None
+
+
+@pytest.mark.asyncio
+async def test_delete_folder_not_empty_maps_to_409():
+    handler, _service = _make_handler(
+        {
+            "success": False,
+            "code": "not_empty",
+            "error": "Folder still contains 2 model file(s); delete or move them first",
+            "manifest": {"model_count": 2},
+        }
+    )
+
+    response = await handler.delete_folder(
+        FakeRequest({"folder_path": "/library/full"})
+    )
+
+    assert response.status == 409
+    payload = json.loads(response.text)
+    assert payload["success"] is False
+    assert payload["code"] == "not_empty"
+    assert payload["manifest"]["model_count"] == 2
+
+
+@pytest.mark.asyncio
+async def test_delete_folder_busy_maps_to_409():
+    handler, _service = _make_handler(
+        {"success": False, "code": "busy", "error": "staged delete pending"}
+    )
+
+    response = await handler.delete_folder(
+        FakeRequest({"folder_path": "/library/full"})
+    )
+
+    assert response.status == 409
+    assert json.loads(response.text)["code"] == "busy"
+
+
+@pytest.mark.asyncio
+async def test_delete_folder_containment_failure_maps_to_400():
+    handler, _service = _make_handler(
+        {
+            "success": False,
+            "error": "Folder path '/etc/evil' is outside configured library directories",
+        }
+    )
+
+    response = await handler.delete_folder(FakeRequest({"folder_path": "/etc/evil"}))
+
+    assert response.status == 400
+    payload = json.loads(response.text)
+    assert payload["success"] is False
+    assert "outside configured library" in payload["error"]
+
+
+@pytest.mark.asyncio
+async def test_delete_folder_invalid_json_body():
+    class BadJsonRequest:
+        async def json(self):
+            raise ValueError("bad json")
+
+    handler, _service = _make_handler({"success": True})
+
+    response = await handler.delete_folder(BadJsonRequest())
+
+    assert response.status == 400
+    assert json.loads(response.text)["success"] is False