Fix Filesystem resource and token authorization boundaries

[Icemap]

Summary

• require an explicit File System ID and TiDB Cloud API credentials for resource describe/delete operations, so TI_FS_TOKEN cannot authorize resource deletion
• allow an owner FS token to derive its File System ID for token inventory, enable, disable, and revoke operations while keeping TiDB Cloud credential flows explicit
• improve command help and errors, add black-box and service-level coverage, and update the read-only Drive9/fs references used for implementation context

Testing

• make test
• make e2e