fix(vfs): V-04 — structured anti-leak shield rules and custom filter list

src/mount.rs

@@ -84,6 +84,7 @@ pub async fn mount_container(
     idle_timeout: Option<u64>,
     lock_on_screen_lock: bool,
     anti_leak: bool,
+    anti_leak_list: Option<&Path>,
     stealth: bool,
 ) -> Result<()> {
     let drive_str = format_drive(drive_letter);
@@ -191,16 +192,38 @@ pub async fn mount_container(
     rand::RngCore::fill_bytes(&mut rand::rngs::OsRng, &mut token_bytes);
     let session_token = hex::encode(token_bytes);
 
+    // Benutzerdefinierte Anti-Leak Filterregeln laden (V-04)
+    let custom_leak_rules = if let Some(path) = anti_leak_list {
+        match crate::vfs::load_anti_leak_list(path) {
+            Ok(rules) => {
+                if !stealth {
+                    println!(
+                        "  • Anti-Leak Liste:   {} benutzerdefinierte Regeln geladen",
+                        rules.len()
+                    );
+                }
+                rules
+            }
+            Err(e) => {
+                bail!("Fehler beim Laden der Anti-Leak-Regeln: {e}");
+            }
+        }
+    } else {
+        Vec::new()
+    };
+
     // WebDAV Filesystem und Handler konfigurieren (mit Anti-Leak Shield & Carrier-Routing)
-    let fs = SanctumFs::with_carrier(
+    let fs = SanctumFs::with_carrier_and_leak_rules(
         db.clone(),
         dek,
         carrier_dek,
         carrier_node_id,
         version,
         anti_leak,
+        custom_leak_rules,
         vault_id,
     );
+    let fs_leak_counter = fs.leak_counter();
     let last_activity = fs.last_activity();
     let dav_server = DavHandler::builder()
         .filesystem(Box::new(fs))
@@ -584,6 +607,14 @@ pub async fn mount_container(
             println!("{}", ui::green("OK"));
         }
 
+        let blocked_leaks = fs_leak_counter.load(Ordering::Relaxed);
+        if blocked_leaks > 0 {
+            println!(
+                "  • Anti-Leak Shield:  {} Zugriffe auf Metadaten-/Leak-Dateien blockiert.",
+                ui::cyan(&blocked_leaks.to_string())
+            );
+        }
+
         println!();
         println!(
             "{} Sanctum Container wurde sicher und vollständig geschlossen.",