73c1776e1e
1. conftest.py: add missing `from server.main import app` import 2. dependencies.py: get_db() reuses middleware session instead of creating independent AsyncSessionLocal (fixes double-session bug) 3. auth_jwt.py: get_optional_admin uses request.state.db instead of creating leaked AsyncSessionLocal session 4. config.py: default DATABASE_URL uses mysql+aiomysql (not pymysql) 5. sync_engine_v2.py: sanitize config keys with regex, escape values to prevent command injection in sync_config 6. sync_v2.py: add POST /api/sync/browse endpoint for remote dir listing 7. files.html: browseDir calls real API instead of placeholder stub Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>