fix: handle explorer directory path segments

[thiennamdinh]

Summary

• Parse ledger directory pair entries like [name, type] without stringifying the whole pair as a child name.
• Add Explorer-side R7RS/percent path segment encoding for create, upload, and rename paths.
• Decode percent-escaped ledger path segments for Explorer display while preserving encoded path segments for API calls.
• Ignore non-string directory keys that are invalid for the current public path contract.
• Bump platform metadata and compose image defaults to 1.3.2 for an immutable patch release tag.
• Adjust release CI so versioned main merges promote branch-validated SHA images instead of rebuilding expensive multi-arch images on main.
• Refresh related WebDAV/path/release docs, including API-token auth, path escaping, and Windows client limitations.

Testing

• cd services/explorer && npm test -- --watchAll=false
• cd services/explorer && npm run build
• API check confirmed ['*state*', 'tdinh', 'hello-2.txt'] returns a byte-vector while the previous bad path hello-2.txt,value returns nothing.
• Live Playwright checks against djali.net confirmed:
  • existing file content renders instead of nothing;
  • creating/selecting a document with spaces succeeds without path-error;
  • the UI displays the decoded space-containing name while the ledger stores the percent-escaped symbol.
• User confirmed the initial fixed Explorer behavior on djali.net after redeploy.
• CI validation image workflows have been dispatched for the final PR head so the 1.3.2 main merge can promote SHA-tagged artifacts.

Notes/Risks

• The deployed djali.net Explorer has been temporarily rebuilt locally with this fix under the 1.3.1 image tag; this PR bumps the official release target to 1.3.2 rather than reusing the published 1.3.1 tag.
• Recreating Explorer required recreating Router afterward so nginx resolved the new Explorer container address.
• Windows built-in WebClient/MiniRedir remains best-effort; the docs now recommend a dedicated client such as rclone with WinFsp when the built-in client cannot resolve the WebDAV URL.