fayerman-source closes a cross-project folder gap

Project folders in Mike are meant to live inside a single project, but a handful of operations were taking folder IDs from the client without first checking that the folder actually belonged to the caller's project. In practice that meant a user acting in Project A could, in theory, hand the system a folder ID from Project B and have it accepted.

fayerman-source added ownership checks at the three places this could bite: moving a folder, moving a document into a folder, and deleting a folder along with its documents. Each now confirms the folder belongs to the current project before doing anything. It's the classic shape of an authorization gap - trusting an ID the client supplied - and the fix is correspondingly small and surgical, with no changes to the surrounding APIs.