Search files and folders by name across the whole company.

Case-insensitive substring match on name. Results are gated by the same per-resource VIEWER and attachment row checks the list endpoints use. Empty q returns empty results without touching the database — the guard runs before the permission-graph lookups so an empty query is truly free.