feat(files): orchestrate connector folder sync

docs/CONNECTOR_SPACES.md

@@ -61,11 +61,10 @@ Linked connector space:
 - read-only flag from provider/policy
 - active/deleted state
 
-The linked space should be addressable as a normal file space in the files UI.
-For the first implementation slice, actions may use the existing connector
-browse/sync APIs and managed file storage. A linked space can therefore browse
-the remote folder and sync selected files into managed storage. Later slices can
-add a native remote listing view or background sync jobs.
+The linked space is addressable as a normal file space in the Files UI. It can
+browse the remote folder, synchronize one selected file, or run a bounded manual
+folder synchronization into managed storage. Background sync jobs remain a
+separate scheduling concern.
 
 ## Policy Semantics
 
@@ -105,6 +104,9 @@ Implemented:
 - Files UI sync dialog for choosing a profile, browsing a remote folder, and
   syncing a selected file into a managed destination folder
 - Files UI connector-space view with provider/read-only/manual-sync state
+- bounded folder-level manual sync with recursive traversal, pagination,
+  per-item review outcomes, source-provenance matching, and one summary audit
+  event
 - Docker dev stack smoke checks for WebDAV, Nextcloud, and SMB
 
 Missing:
@@ -137,9 +139,14 @@ Missing:
    - Remaining: edit/manage actions for existing linked spaces.
 
 4. Add sync orchestration.
-   - Manual sync selected file is already available.
-   - Add folder-level manual sync.
-   - Add optional scheduled/background sync with conflict reporting.
+   - Manual selected-file and folder-level synchronization are available.
+   - Folder sync preserves remote relative paths, bounds file count and depth,
+     and reports created, updated, unchanged, skipped, conflict, policy-denied,
+     and failed items without rolling back successful siblings.
+   - The default conflict strategy is `skip`, so unrelated managed files are
+     left untouched. `rename`, `reject`, and `overwrite` remain explicit choices.
+   - Add optional scheduled/background sync separately; it must reuse the same
+     policy, provenance, result, and audit contracts.
 
 5. Add provider-specific expansion.
    - OAuth/secret-store credentials.