fix: Undo robustness — missing parent mkdir and boundary check

[deucebucket]

Bug

api_undo() (app.py ~line 8581) has two robustness issues:

1. Missing parent directory creation — If the original author folder was cleaned up after a rename (empty dir cleanup at ~line 6340), the undo shutil.move(new_path, old_path) fails because the parent directory no longer exists.
2. Library boundary check already tracked in fix: Library boundary enforcement missing in undo/replace/remove paths #219 — mentioned here for completeness.

Fix

Add Path(old_path).parent.mkdir(parents=True, exist_ok=True) before the shutil.move() call in api_undo().

Severity

Medium — undo silently fails when the original parent folder was cleaned up.

Found via code audit.