Expose per-folder default values via OCS API

[Rikdekker]

Summary

The per-folder default values feature (added in v2.2.0) is configurable through the web UI but has no OCS API. External integrations (scripts, migrations, automation using an app-password / Bearer token) cannot read or set field defaults — the existing endpoints are CSRF-protected web routes only.

Current state

The defaults endpoints live in the web routes surface, not the ocs surface, in appinfo/routes.php:

Endpoint	Verb	Purpose
/api/groupfolders/{id}/defaults	GET	get configured defaults (by field id)
/api/groupfolders/{id}/defaults	POST	set/clear a field default — { fieldId, value }
/api/groupfolders/{id}/defaults/trigger	POST	queue a discovery/backfill run
/api/groupfolders/{id}/defaults/status	GET	poll whether backfill is still running

These are handled by DefaultsController (extends BaseController, #[NoAdminRequired], requires manage_fields on the folder) and are CSRF-protected — usable only from an authenticated browser session, not from an external client.

There is no OCS equivalent (verified: the ocs route block has zero default entries). The only non-UI path today is the occ metavox:apply-defaults command, which applies existing defaults but does not configure them.

Proposal

Expose the defaults functionality on the OCS API, mirroring the existing Api*Controller pattern (ApiFieldController / ApiFilterController / ApiViewController + BaseOCSController):

• GET /api/v1/groupfolders/{groupfolderId}/defaults — list configured defaults
• POST /api/v1/groupfolders/{groupfolderId}/defaults — set/clear a default ({ fieldId, value })
• POST /api/v1/groupfolders/{groupfolderId}/defaults/trigger — queue backfill
• GET /api/v1/groupfolders/{groupfolderId}/defaults/status — backfill status

Implementation notes:

• Add an ApiDefaultsController extends BaseOCSController that delegates to the existing DefaultsService (so behaviour stays identical to the web controller — no logic duplication).
• Keep the same authorization: require manage_fields permission on the groupfolder.
• Reuse the same value validation as the web setDefault (type-correct per field type, null = clear).
• Document the new endpoints under docs/ (and the NL docs/*.nl.md source-of-truth), consistent with how the other OCS endpoints are documented.

Why

This enables SharePoint-style bulk provisioning use cases — e.g. a migration script that creates Team folders, defines fields, and seeds their default values end-to-end without a human clicking through Personal/Admin settings. It rounds out the API parity that fields, metadata, filters and views already have on OCS.

Acceptance criteria

• OCS endpoints for get/set/trigger/status of folder defaults
• Authorized via app-password/Bearer (no CSRF requirement), gated on manage_fields
• Shared logic with the web controller (via DefaultsService), no behavioural drift
• Docs updated (EN + NL source)

Spun off from the v2.2.0 release work — targeted at a future release.

[Rikdekker]

Related: #83 — same theme (OCS-API parity for v2.2.0 features), covering the reworked File Link field (backlinks endpoint, path↔fileId resolution, value validation).