Refactor/security check and forlders workflow

[saktush]

This branch covers two major workstreams: a security & performance hardening pass (audit-driven) and a folders feature addition, plus related fixes and tests.

Security hardening

• Validate uploadId as a UUID before path.join() to prevent path traversal (S1)
• Use timing-safe token comparison and unified 401 error messages to prevent timing attacks and config-state leakage
• Wrap pino logger to automatically redact sensitive data (tokens, auth headers)
• Evict session maps on transport close to prevent memory leaks
• Introduce session token validation with secure storage (src/utils/session-auth.ts)
• Bind default LISTEN_HOST to 127.0.0.1 when a token is set (prevents unintended network exposure)
• Extract upload auth validation to src/utils/upload-auth.ts and remove the debug /uploads endpoint

Performance improvements

• Add 30s timeout and HTTP keep-alive agents to the axios instance
• Early-exit folder resolution loop on first match instead of always paginating 20 pages
• Skip getTask() in createTimeEntry/listTimeEntries when taskId is already a UUID
• Switch fs.readFileSync to fsPromises.readFile (async) in oob-upload.ts
• Parallelize orphan upload file deletion with Promise.all

Folders feature

• Implement list_folders, get_folder, get_folder_tree, and find_folder tools (src/tools/folders/)

Bug fixes & quality

• Fix workitem creation flow
• Fix lint errors across tool files (structured logger.info replacing console.error success logs)
• Add unit tests for upload handler and auth utilities (src/tests/)
• Add integration test skeleton (src/tests/integration/)