fix(rename): block rename for password-protected paths

[skysliences]

Summary

• block single-file rename when target path is protected by meta password
• block batch/regex rename for each file when target path is protected by meta password
• return clear error message: "Path is password-protected and cannot be renamed."

Behavior

When a path matches a meta rule with a non-empty password (p_sub respected), rename operations are rejected with HTTP 403.

Scope

• server/handles/fsmanage.go
• server/handles/fsbatch.go