Blogs: list personal files under the user's login, not the sub claim

GET api/v1/fs passed User.GetUserId() (the "sub" claim — a GUID in
production) to GetUserFiles, so the listing looked under
{Blog}/{sub-GUID}. But the personal-storage tree is keyed by the
user's login everywhere else: EnsureDestinationDirectory writes under
{Blog}/{name-claim}, the download endpoint and avatar paths use
user.UserName. So once the upload path was fixed (previous commit),
files landed under {Blog}/{login} while the listing still looked under
{Blog}/{GUID} — an empty tree — hence the PostIt "Mes fichiers" page
listing nothing.

GetDir now resolves the user from the DB (as Post already does) and
lists under user.UserName. UploadedFile.OwnerId stays "sub", so
EnrichWithFileIds still queries by uid.

Tests:
- TestTokenIssuer.Issue gains an optional `name` param (defaults to
  subject, preserving existing behavior) so a test token can mirror
  production where sub (GUID) ≠ name (login).
- FileSystemApiTests.Get_fs_lists_files_stored_under_the_user_login
  decouples sub from the login, uploads under the login, and asserts
  GET /api/v1/fs returns the file (and the subject-named directory does
  NOT exist). Verified to fail when the controller uses uid for the
  listing.

Co-Authored-By: Claude Code <noreply@anthropic.com>

src/Yavsc.Tests.Shared/TestTokenIssuer.cs

@@ -63,11 +63,18 @@ public static class TestTokenIssuer
     /// <param name="scope">Value of the <c>scope</c> claim. The
     /// production <c>BlogScope</c> policy requires
     /// <c>RequireClaim("scope", "blogs")</c>.</param>
+    /// <param name="name">Value of the <c>name</c> claim. Defaults to
+    /// <paramref name="subject"/> (the test convention where the login
+    /// equals the subject). Pass a distinct login to mirror production,
+    /// where <c>sub</c> is a GUID and <c>name</c> is the user's
+    /// <c>UserName</c> — the file-system list/upload paths key the
+    /// personal-storage tree off the login, not the subject.</param>
     /// <param name="extraClaims">Optional additional claims
     /// (e.g. a role for an admin-bypass test).</param>
     public static string Issue(
         string subject,
         string scope = "blogs",
+        string? name = null,
         IEnumerable<Claim>? extraClaims = null)
     {
         var now = DateTime.UtcNow;
@@ -81,7 +88,7 @@ public static class TestTokenIssuer
             // — not via User.Identity.Name. A test token without "name" would
             // make ReceiveUserFile / EnsureDestinationDirectory compute a
             // null owner root and 500 on upload, so stamp it here.
-            new("name", subject),
+            new("name", name ?? subject),
             new("scope", scope),
         };
         if (extraClaims is not null) claims.AddRange(extraClaims);