feat: make public folders a config opt-in

src/backend/src/services/auth/ACLService.js

@@ -56,10 +56,12 @@ class ACLService extends BaseService {
         }
         
         // Hard rule: anyone and anything can read /user/public directories
+        if ( this.global_config.enable_public_folders ) {
             const public_modes = ['read', 'list', 'see'];
             if ( public_modes.includes(mode) ) {
                 if ( await fsNode.isPublic() ) return true;
             }
+        }
 
         // Access tokens only work if the authorizer has permission
         if ( actor.type instanceof AccessTokenActorType ) {