feat(fuse,core,gui,cli): one-request move+rename drain, show who shared an item

- A queued rename that also changes folder now lands as one `move-multiple`
  request carrying the target name instead of rename-then-move, so there is
  no half-applied state and no second call for stale name requirements to
  hit (B46 follow-up). A destination name collision moves under a conflict
  name in one step; same-folder renames still use the rename endpoint.
- Shared with me shows the inviter and invite date (GUI subtitle, `pdfs
  shared-with-me`), with a warning when the invitation signature does not
  verify against the claimed inviter's keys. `DirEntry` gains `shared_by`,
  `shared_at` and `shared_by_unverified`, all serde-defaulted.
- Bump `proton-sdk` / `proton-drive-rs` to 0.6.3 (anonymous-node moves,
  `TrashTime` trashed detection).

crates/pdfs-core/src/control.rs

@@ -906,6 +906,22 @@ pub struct DirEntry {
     /// report. Defaulted for wire-compat with clients/daemons predating it.
     #[serde(default)]
     pub role: String,
+    /// Who shared this node with me, as the invitation claims it — empty for
+    /// content I own, for a node reached *inside* a shared folder (only the share
+    /// root carries the invitation), and when the API did not say. Trust it only
+    /// as far as [`shared_by_unverified`](Self::shared_by_unverified) allows.
+    /// Defaulted for wire-compat with clients/daemons predating it.
+    #[serde(default)]
+    pub shared_by: String,
+    /// When it was shared with me, epoch seconds; 0 when unknown.
+    #[serde(default)]
+    pub shared_at: i64,
+    /// The invitation's signature did not check out against `shared_by`'s keys,
+    /// so the name may be forged. False when it verified *and* when it could not
+    /// be checked at all (no signature, no keys): only an actual mismatch is a
+    /// warning worth showing.
+    #[serde(default)]
+    pub shared_by_unverified: bool,
 }
 
 /// One hit in a [`Request::Search`] result. Like [`DirEntry`] but carries the