Cross-account folder creation via owner overwrite

Missing authorization in Open WebUI before 0.9.0 allows remote authenticated users to create folders in other users' accounts. FolderForm accepts an attacker-supplied user_id because extra fields are allowed, and insert_new_folder spreads that form data over the server-assigned owner. A normal account with the default folders permission and a victim UUID is sufficient; the result is unauthorized folder writes and phishing or spam, not folder reads.