`Permission denied: b'/.hist'` when viewing image thumbnails from root directory

### Describe the bug
When I launch copyparty from my root directory and navigate to a subdirectory I have images in, the thumbnail HTTP requests receive 500 responses and so no thumbnails are shown in the browser.

For each requested thumbnail, the terminal logs:
```
11:47:10.097 192.168.0.13 36008 http500: bos.py:30 : os.makedirs(bname, mode)
:218 :
:218 :
:218 :
:218 :
:218 :
:228 :
[PermissionError] [Errno 13] Permission denied: b'/.hist', '/home/oboro/nagito/1750018310.png'
```
which I suppose means that `.hist` is required to store thumbnails, and since my user doesn't have write permissions to the root directory, it fails

### To Reproduce
```
cd /
copyparty
# navigate to /home/user/images/your_image_dir in the copyparty frontend
# no thumbnails are displayed
```

### Expected behavior
I expect I can still see thumbnails, through more graceful behaviour, like temporarily storing thumbnails in memory or in a temp dir if `.hist` isn't able to be written. Alternatively:
- A check on startup with a log message making it clear that images won't be available, citing that I don't have write permissions in the working directory.
- Some sort of visual feedback in the web UI telling me what's wrong
- etc.

### Server details (if you're NOT using docker/podman)
- Arch Linux
- official Arch package `copyparty 1.18.2-1`
```
copyparty v1.18.2 "logtail" (2025-07-07)
CPython v3.13.5 on Linux64 [GCC 15.1.1 20250425]
sqlite 3.50.3*1 | jinja 3.1.6 | pyftpd (None) | tftp (None)
```

### Client details
The client sees receives a 500 HTTP response for the thumbnail request, so it's not a browser issue

错误源自 bos.py 第 30 行，在那里调用了 os.makedirs。查看 thumbnail 生成和缓存逻辑，可能在处理 thumbnails 或创建 .hist 目录的模块中。弄清楚 thumbnail 存储路径是在哪里确定的，以及当默认位置不可写时如何 fallback 到可写位置（例如临时目录）。通过从根目录运行 copyparty 并验证 thumbnails 在该 fix 下可正常工作来测试。

由索引模型根据 Issue 内容生成。