Browse the file manager ("Dateien") as a filesystem

Many teachers never use topics or boards; their material sits in the
course's file area, and the tools answered "0 files" for courses holding
dozens of worksheets — 21 of 26 courses on the live account. Persönliche,
Kurs-, Team- and Geteilte Dateien live in the legacy file store, not in
files-storage, and its service is not in the public ingress. The only way in
is the legacy client: HTML listings, and GET /files/signedurl for a
pre-signed download.

core/legacy-files.ts turns that into one path tree — /my, /courses/<course>,
/teams/<team>, /shared — resolving names that contain "/", ids anywhere in a
path, and wrong or ambiguous names with a message saying what is there. A
listing that does not parse throws; it never reads as an empty folder.

Some of the legacy client's GET routes write (GET /files/share/ mints a
share token), so getFileManagerPage allows only the listing routes, by
pattern. Signed URLs are fetched with no credentials and must be https.

- MCP: fs_list, fs_tree, fs_find and fs_read; get_course lists course files.
- CLI: schulcloud fs ls, tree, find and get, recursive and resumable.
- API: /api/fs/list, tree, find and file.
- Index: the crawl walks the file manager (INDEX_FILE_MANAGER, on by
  default), so search covers the text inside those files and sync mirrors
  them under <course>/Kurs-Dateien.

The local instance gains a fixture for all four areas. It needed a loopback,
so signed URLs open from the host, and a pre-created bucket, since MinIO
does not implement PutBucketCors.

135 tests. Smoke 55/55 live; 57/57 and 55/55 on the local instance.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

local-instance/docker-compose.yml

@@ -154,6 +154,24 @@ services:
       minio: {condition: service_healthy}
     restart: unless-stopped
 
+  minio-loopback:
+    # The legacy file service (the file manager: Persönliche/Kurs-/Team-Dateien)
+    # signs upload and download URLs for its storage provider's one endpoint, and
+    # the same endpoint serves its own S3 calls. "minio:9000" works inside the
+    # compose network and nowhere else, so a browser or the MCP server on this
+    # machine was handed URLs it could not open: uploads through the UI failed
+    # and downloads could not be tested. seed.sh registers the provider as
+    # http://localhost:9900 instead, and this forwards that address to MinIO from
+    # inside the api container's own network namespace — so the one URL now
+    # works from the api, from the browser and from the host alike.
+    image: alpine/socat:1.8.0.1
+    network_mode: "service:api"
+    command: ["TCP-LISTEN:9900,fork,reuseaddr,bind=127.0.0.1", "TCP:minio:9000"]
+    depends_on:
+      api: {condition: service_started}
+      minio: {condition: service_healthy}
+    restart: unless-stopped
+
   file-preview:
     # Generates thumbnails via ImageMagick, driven off RabbitMQ. Optional: with
     # it absent, files still upload and download, they just have no preview.