api: return 400 instead of panicking on unreadable storage path

[moToroTor]

Adding a local storage folder panics the server when os.Stat fails with anything but not-exist (e.g. EACCES on a service-user install):

if fi, err := os.Stat(r.Path); os.IsNotExist(err) || !fi.IsDir() {

IsNotExist is false, so !fi.IsDir() dereferences the nil FileInfo. Every click panics (recovered per-connection by net/http, folder never added):

runtime error: invalid memory address or nil pointer dereference
github.com/xbapps/xbvr/pkg/api.ConfigResource.addStorage(...)
    /src/pkg/api/options.go:655

This factors the check into resolveVolumePath, which treats any stat failure as a bad path, and the endpoint keeps its existing 400 response. Adds TestResolveVolumePath (missing path, file, and permission-denied cases).

Note: I could not run the app test suite locally on a pristine checkout (go test hits the flag.Parse issue from #2252); the identical code passes here via CI-worthy paths and was verified green on my fork.