List Folders

List folders the caller REACHES, directly or by inheritance.

Augmented with derived counts and a member preview so the sidebar can render avatar stacks and stat cards without N+1 calls.

TOS-2131: this used to query library_members directly for the caller's active rows, which demanded a grant on the exact folder. Since TOS-2049 a grant on a folder also grants on every descendant (TOS-1824 §1.5), so an inheritance-only folder resolved through /api/folders/resolve but was absent from this list - and the SPA matches address deep links against this list, so the deep link 404'd on a folder the API said the caller reached. services/access/domain_reach is THE definition of that rule; this surface now reads it instead of re-implementing membership.

Not keyset-paginated (TOS-3280 audit): unlike documents/segments/members, the folders one identity reaches is bounded by admin-granted membership and tree depth, not by content volume, and the preview-fetch below already documents the expected scale as "<200 folders per user". Paginating it would also mean restructuring reachable_domains_subquery/ administered_library_ids (services/access/), which this endpoint only reads.