feat(resources): public resource serve + listing endpoints

[rubenvdlinde]

Summary

Adds the read side of the resource-uploads capability per REQ-RES-006..008, complementing the admin-only upload pipeline merged in #46.

• GET /apps/mydash/resource/{filename} — non-OCS plain web route streaming bytes via php://memory with extension-derived Content-Type and Cache-Control: public, max-age=31536000.
• GET /apps/mydash/api/resources — listing endpoint returning {status, resources: [{name, url, size, modifiedAt}]} ordered by modifiedAt desc; empty folder returns HTTP 200 with [].
• Path traversal blocked at routing layer ([^/]+) plus controller-level defence in depth (.., \\, empty/dot values) yielding uniform HTTP 404.
• 50 MB+ files (only reachable via manual filesystem tampering) refused with HTTP 413 BEFORE bytes are loaded — bounds memory to the 5 MB upload cap from REQ-RES-003.
• uniqid suffix on REQ-RES-004 filenames doubles as cache buster — a logical asset change yields a brand-new filename, naturally bypassing the one-year immutable cache.

Implementation notes

• New ResourceServeController + ResourceServeService pair, kept separate from the upload ResourceController so the dependency graph stays under the PHPMD CouplingBetweenObjects limit.
• Both endpoints carry @NoAdminRequired — admin gating would lock dashboards out of their own assets, since uploaded resources are referenced from every dashboard render.
• Routes registered under the standard routes array (mydash currently has no OCS controller infrastructure). Pragmatic deviation from tasks.md 2.2 (which suggested registering listResources under ocs) — keeps the read surface consistent with the existing POST /api/resources upload route on the same path. Behaviourally identical from the dashboard's perspective.
• OpenAPI spec update (task 5.2) skipped — no OpenAPI artefact exists in this repo to update.
• Pre-existing PHPStan warning in ImageMimeValidator fixed in passing (dead ?? '' on a non-nullable field).

Test plan

• PHPUnit: 19 new tests covering all 8 spec scenarios — PNG bytes + headers, SVG image/svg+xml content-type, unknown ext → octet-stream, missing file → 404, encoded traversal → 404 (8 vectors via @dataProvider), oversize → 413 with no getContent() call, list ordering desc, empty folder → []. All 208 tests pass.
• composer check:strict — lint, phpcs, phpmd, psalm, phpstan, test:all all green.
• SPDX headers on every new PHP file (in the docblock per the SPDX-in-docblock convention).
• Manual smoke test in the dev container (uploading via the existing admin UI then fetching the served bytes) — to be validated by the reviewer during code review.
• Playwright tasks 4.1/4.2 (image widget renders the served URL; unauthenticated request redirects to login) — left for a follow-up Playwright change since the existing repo has no Playwright suite yet.

[github-actions]

Quality Report — ConductionNL/mydash @ 8c7c677

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 103/103
npm			✅	✅ 342/342
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

---

Quality workflow — 2026-04-30 12:34 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/mydash @ 0352b88

Check	PHP	Vue	Security	License	Tests
lint	⏭️
phpcs	⏭️
phpmd	⏭️
psalm	⏭️
phpstan	⏭️
phpmetrics	❌
eslint		❌
stylelint		⏭️
composer			⏭️	⏭️
npm			⏭️	⏭️
PHPUnit					❌
Newman					❌
Playwright					❌

---

Quality workflow — 2026-04-30 12:36 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/mydash @ cf90700

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 103/103
npm			✅	✅ 342/342
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

---

Quality workflow — 2026-04-30 12:38 UTC

Download the full PDF report from the workflow artifacts.