fix: address minor issues for v0.9.1 preparation (K-01 mount verification, path validation, legacy-names warning, V1-V2 migration docs)

tests/mount_security_test.rs

@@ -309,3 +309,85 @@ async fn test_z04_webdav_quota_report() {
     drop(db);
     let _ = std::fs::remove_file(&container_path);
 }
+
+#[tokio::test]
+async fn test_mount_rejects_tampered_metadata_mac() {
+    let temp_dir = std::env::temp_dir();
+    let container_path: PathBuf = temp_dir.join(format!(
+        "test_mount_tampered_mac_{}.sanctum",
+        std::process::id()
+    ));
+    if container_path.exists() {
+        let _ = std::fs::remove_file(&container_path);
+    }
+
+    let password = "TestTamperedMacPassword2026!";
+    let salt = generate_salt();
+    let kdf_params = KdfParams {
+        memory_cost: MIN_MEMORY_COST_KIB,
+        time_cost: MIN_TIME_COST,
+        parallelism: 1,
+    };
+    let kek = derive_kek(password, &salt, &kdf_params).unwrap();
+    let dek = generate_dek();
+    let (wrapped_dek, nonce, tag) = wrap_dek(&kek, &dek).unwrap();
+
+    let db = Database::open(&container_path).unwrap();
+    db.init_schema(&salt, &kdf_params, &wrapped_dek, &nonce, &tag)
+        .unwrap();
+    db.set_active_slot_and_dek(0, dek.clone());
+
+    // Erstelle einen Testknoten
+    let node = db.create_node(1, "original.txt", false).unwrap();
+    db.update_metadata_mac().unwrap();
+
+    // Vor Manipulation: verify_metadata_mac muss erfolgreich sein
+    assert!(db.verify_metadata_mac_for_slot(0, &dek).unwrap());
+
+    // Manipuliere SQLite-Metadaten direkt (Böswilliger Angreifer)
+    {
+        let conn = rusqlite::Connection::open(&container_path).unwrap();
+        conn.execute(
+            "UPDATE nodes SET name = 'hacked.exe' WHERE id = ?1",
+            [node.id],
+        )
+        .unwrap();
+    }
+
+    // Nach Manipulation: Direkte Verifikation meldet 'false' (Integritätsbruch)
+    assert!(!db.verify_metadata_mac_for_slot(0, &dek).unwrap());
+
+    drop(db);
+
+    // Aufruf von mount_container muss fail-closed abbrechen
+    let auth =
+        sanctum::mount::ContainerAuth::Password(zeroize::Zeroizing::new(password.to_string()));
+    let res = sanctum::mount::mount_container(
+        &container_path,
+        'Z',
+        None,
+        Some(18943),
+        auth,
+        false,
+        false,
+        None,
+        false,
+        false,
+        None,
+        true,
+    )
+    .await;
+
+    assert!(
+        res.is_err(),
+        "Mount mit manipulierten Metadaten muss fehlschlagen!"
+    );
+    let err_msg = res.unwrap_err().to_string();
+    assert!(
+        err_msg.contains("Metadaten-MAC-Verifikation fehlgeschlagen") || err_msg.contains("K-01"),
+        "Erwartete Fehlermeldung zu K-01 Metadaten-MAC, erhalten: {}",
+        err_msg
+    );
+
+    let _ = std::fs::remove_file(&container_path);
+}