feat(graph): add metadata API for custom xattrs (GET + PUT)

[flash7777]

Summary

• GET /graph/v1beta1/drives/{driveID}/items/{itemID}/metadata — returns all custom metadata (user.oc.md.*) as JSON
• PUT /graph/v1beta1/drives/{driveID}/items/{itemID}/metadata — sets metadata from JSON body, keys map to user.oc.md.{key} xattrs

This enables client-side features like notes, classifications, or any custom properties without requiring WebDAV PROPPATCH (which has namespace/key mapping issues for oc: properties).

Test plan

• Upload a file, PUT {"note": "test"} to metadata endpoint, verify xattr user.oc.md.note is set
• GET metadata endpoint, verify {"note": "test"} is returned
• Test with special characters (umlauts, CJK, emoji)
• Verify permission check (only users with upload permission can set metadata)

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 20 complexity · 4 duplication

Metric	Results
Complexity	20
Duplication	4

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[dschmidt]

This should be spec'ed in https://github.com/opencloud-eu/libre-graph-api first before the endpoints are added here.

See my PR opencloud-eu/libre-graph-api#35 for an attempt to achieve something similar (I believe :))
Especially see @butonic 's response for open extensions vs. fieldsets. I'm not sure which way we want to go.
Also by now I'm thinking we need some typing information, so it can be indexed better (e.g. geo data, date information etc. should possibly not be stored just as strings e.g.) so maybe we don't want to do it completely schemaless? But then how do we want to handle schema changes? It's a can of worms honestly.

Additional feedback on my PR would be greatly appreciated :)