Lists: list folders (`/api/folders`) — a separate domain from document folders

[Adron]

Gap

The app implements document folders (/api/documents/folders) but not list folders, which are a distinct resource under /api/folders. Views/ListsView.xaml has no folder tree.

Endpoints

Method	Path	Notes
GET	/api/folders	all non-deleted list folders for the caller (live-verified {"folders":[]})
POST	/api/folders	create — subscribers only
PUT	/api/folders/{id}	rename or move (reparent)
DELETE	/api/folders/{id}	soft-delete a folder and its subfolders

Lists reference their folder through ListSummary.folderId.

Acceptance criteria

• Services/InterlinedApiClient.ListFolders.cs (or a section of .Lists.cs) with all four operations.
• Folder tree in Views/ListsView.xaml, nesting via parentId.
• Create / rename / move / delete; delete confirms in place and states that subfolders go too.
• Lists can be assigned to a folder (folderId).
• 402/403 on create renders the upgrade-needed state.

[Adron]

Implemented in #180 — work continues in the PR from here.

The server does not guard against cycles. Moving a folder into its own child returns 200 and creates a genuine loop — verified by doing it (then repairing it). So WouldCreateCycle isn't politeness, it's the only thing preventing an infinite tree walk; and the tree build is separately cycle-tolerant, since the data can already contain a loop.

Also: folderId is not among the eleven fields POST /api/lists accepts, so a list can't be created into a folder — PUT /api/lists/{id} with {folderId} works instead (exposed as SetListFolderAsync). See #179. Additive only; hosting in ListsView is a one-line add once the #161/#163/#164 stack lands.