3.0.2: feat(admin-shell): LFM image folder follows the per-action working store

Decouple the LFM private folder from session('adminStoreId') (which is now the fixed
per-session security scope). The store an image belongs to is a $working_dir resolved
per action: a scoped-login session is fixed to its store; a root session takes the
store the opening form passes (?working_store=), validated + remembered so LFM's later
upload/list AJAX (which drop the query param) hit the same folder; missing/root → shared.

- gp247_process_private_folder(): drop the dead type-prefix branch; read the remembered
  working store; scoped session → its store; else shared
- media-input: add a working-store prop, always append &working_store= (empty resets)
- new LfmWorkingStore middleware on the uploads route group: server-authoritative —
  only remembers an EXISTING store (blocks folder injection / path traversal), resets on
  empty; a store-admin's folder stays forced from session, never this param

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>