Expose per-folder default values via OCS API

Summary

The per-folder default values feature (added in v2.2.0) is configurable through the web UI but has no OCS API. External integrations (scripts, migrations, automation using an app-password / Bearer token) cannot read or set field defaults — the existing endpoints are CSRF-protected web routes only.

Current state

The defaults endpoints live in the web routes surface, not the ocs surface, in appinfo/routes.php:

These are handled by DefaultsController (extends BaseController, #[NoAdminRequired], requires manage_fields on the folder) and are CSRF-protected — usable only from an authenticated browser session, not from an external client.

There is no OCS equivalent (verified: the ocs route block has zero default entries). The only non-UI path today is the occ metavox:apply-defaults command, which applies existing defaults but does not configure them.

Proposal

Expose the defaults functionality on the OCS API, mirroring the existing Api*Controller pattern (ApiFieldController / ApiFilterController / ApiViewController + BaseOCSController):

• GET /api/v1/groupfolders/{groupfolderId}/defaults — list configured defaults
• POST /api/v1/groupfolders/{groupfolderId}/defaults — set/clear a default ({ fieldId, value })
• POST /api/v1/groupfolders/{groupfolderId}/defaults/trigger — queue backfill
• GET /api/v1/groupfolders/{groupfolderId}/defaults/status — backfill status

Implementation notes:

• Add an ApiDefaultsController extends BaseOCSController that delegates to the existing DefaultsService (so behaviour stays identical to the web controller — no logic duplication).
• Keep the same authorization: require manage_fields permission on the groupfolder.
• Reuse the same value validation as the web setDefault (type-correct per field type, null = clear).
• Document the new endpoints under docs/ (and the NL docs/*.nl.md source-of-truth), consistent with how the other OCS endpoints are documented.

Why

This enables SharePoint-style bulk provisioning use cases — e.g. a migration script that creates Team folders, defines fields, and seeds their default values end-to-end without a human clicking through Personal/Admin settings. It rounds out the API parity that fields, metadata, filters and views already have on OCS.

Acceptance criteria

• OCS endpoints for get/set/trigger/status of folder defaults
• Authorized via app-password/Bearer (no CSRF requirement), gated on manage_fields
• Shared logic with the web controller (via DefaultsService), no behavioural drift
• Docs updated (EN + NL source)

Spun off from the v2.2.0 release work — targeted at a future release.

Start with appinfo/routes.php, DefaultsController, DefaultsService, and the ApiFieldController, ApiFilterController, and ApiViewController patterns. Add the four OCS routes and document them under docs/ and the corresponding docs/*.nl.md sources, preserving manage_fields authorization and shared validation. Done means app-password or Bearer clients can get, set or clear, trigger, and check default values without CSRF.