[AndreyVMarkelov]

List the contents of a folder shared link before choosing a path to inspect or download, including when the folder is not mounted in the caller's Dropbox.

Adds dbxcli share-link ls <url> [--path /subfolder] [--recursive] with the existing password flags and JSON v1 output. Default text output shows paths in columns, like dbxcli ls; --long (-l) shows type, human-readable file size, and path. Empty folders produce no default text output. Paths stay relative to the shared-link root, including with --path, and results are sorted by path. Repeated/trailing slashes and . components are normalized through validatePath; .., backslashes, and NUL bytes are rejected before normalization.

Reuses the download pagination/path helpers, preserves wrapped API errors, and emits no successful partial listing after traversal failures. Dropbox entry names are validated independently of the host OS; colons and Windows device names are remote names, with local filesystem restrictions checked separately when mapping download destinations. share-link list continues to list shared links themselves. JSON result metadata is identical with and without -l; input metadata includes long: true when requested.

Updates command/help metadata, JSON schemas and golden fixtures, generated docs, and regression tests for both formats, empty folders, column wrapping, JSON metadata/schema consistency, path normalization, Unicode NFC/NFD, Windows-style names, and local download path guards.

Actual output from the built CLI against a live password-protected fixture:

$ dbxcli share-link ls <url> --recursive --password-file <file>
/nested /nested/résumé.txt

$ dbxcli share-link ls <url> --recursive --password-file <file> -l
TYPE   SIZE PATH
folder -    /nested
file   22 B /nested/résumé.txt

Validation:

• go fmt ./..., go vet ./..., go test ./..., go test -race ./cmd/..., and go build ./... passed.
• Configured linters passed with golangci-lint v2.14.0 for the local Go 1.27 toolchain; the installed v2.12.2 cannot read Go 1.27 export data.
• Documentation/schema regeneration is stable; JSON contract/schema tests and the skill contract script passed.
• Live Dropbox checks covered recursive/non-recursive and subfolder listings, empty folders, Unicode, text/JSON output, listed-path downloads with byte-for-byte comparison, error/cancellation cases, and password-protected listings with password/file/prompt inputs. Incorrect passwords were rejected. The owner can also list without supplying the link password.
• Cross-compiled the command test binary for Windows/amd64.
• Live checks verified --path //documents, /documents/, and //documents//./ all normalize to /documents; the listing preserved server-returned Unicode names plus CON, C:notes.txt, and report?.txt. JSON validation and fixture cleanup passed.
• Rebuilt and verified default and -l text output on the same live password-protected folder; both JSON variants validate against the schema and have identical results. All disposable fixture links/folders were cleaned up.

Live pagination was not forced, and a separate-account/unmounted-folder live check remains unverified; both have mock regression coverage. Listings buffer compact result records in memory for sorting and all-or-error output.

Closes #395.