KC-1315, KC-1329: Fix share-folder record expiration and ROE handling

[sshrushanth-ks]

Summary

Fixes share-folder behavior for KC-1315 and KC-1329. Folder access (-e, -p, -o, --expire-in/at, -roe) and record permissions (-r, -d, -s) are now independent flag groups. Expiration applies only to folder user/team access, not per-record timers. Remove with -e revokes folder access only and no longer removes records from the folder.

Changes

KC-1315 — Expiration

• --expire-in / --expire-at apply only to folder user/team protos (SharedFolderUpdateUser / SharedFolderUpdateTeam), not SharedFolderUpdateRecord
• Record protos from -r update can_edit / can_share only (no expiration or ROE on records)
• Fixed short expiration validation (e.g. 1mi) using millisecond-precision timestamps
• Sync-down before share updates when expiration is set

KC-1329 — Remove semantics

• -a remove with -e revokes folder access only; does not call sharedFolderRemoveRecord
• -r / -d / -s can be combined with remove to update record permissions in the same request
• Owner/participant self-removal prompts and validation (backup manager required for owner self-remove)

Validation & safety

• -d / -s require a record target (-r, -r *, or -r @existing)
• -r with a specific record UID/name must already be in the folder; rejects foreign records instead of linking them via sharedFolderAddRecord
• Case-insensitive folder user lookup for -e

Reliability

• Explicit -p / -o always update folder user permissions even when -r is present
• Skip redundant folder user updates only when sharing another record with unchanged permissions and no expiration
• Include API status in user-share failure logs

Help & tests

• Reorganized share-folder help into folder access vs record permissions groups
• Document that -o is mutually exclusive with --expire-at / --expire-in (matches Vault behavior)
• Expanded unit tests in test_command_register.py

Flag model

Area	Flags	Purpose
Folder access	-a, -e, -p, -o, --expire-in/at, -roe	Grant/remove user or team folder access
Record permissions	-r, -d, -s	Update can edit / can share for records already in the folder

-p/-o and -d/-s are independent within their groups.