fix(thumbnails): never plan or delete through a linked key folder (#320)

Review finding P1 on #591: in folder mode a source key folder that is a
link or junction to a folder outside was still handed to the planner, so
Convert outdated could remove an older-format file outside the thumbnail
folder. ensure_store now refuses a linked store before any planning, and
each removal of an old preview passes may_write at the moment it runs.

py/api/thumbnail_convert.py

@@ -44,7 +44,7 @@ import os
 import time
 from pathlib import Path
 
-from . import thumbnail_settings
+from . import preview_store, thumbnail_settings
 from .thumbnail_encode import ThumbnailVerifyError, verify_thumbnail, writer_settings
 from .admin import _plural, _scan_location, _scan_roots, _scan_status_line
 from .images import _thumbnail_is_fresh, _worker_threads, _thumbnail_batch_size
@@ -393,6 +393,12 @@ class ThumbnailConvertMixin:
         removed, with no bytes (another run or a sibling removed it)."""
         removed, kept = 0, []
         for path, size in old:
+            if not preview_store.may_write(path):
+                # Folder mode: never a file outside a key folder, or one
+                # reached through a link (checked at the moment of the delete).
+                self.logger.warning(f"Not removing {path}: outside the thumbnails")
+                kept.append(path)
+                continue
             try:
                 os.remove(path)
             except FileNotFoundError: