CVE-2026-70494: Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

A user granted write access to a shared chat folder could permanently delete chats and messages belonging to the folder’s owner. Deleting a folder cascades into the owner’s chats and the entire subfolder subtree, and the deletion handler required only write access on subfolders instead of ownership. Root folders were restricted to the owner or an admin, subfolders were not.