refactor: MediaFolder->uploadFile now uses EditUser param for permission check AND database insert