synology: full read-surface sweep + FileStation ls graceful fallback

Exercised every Web API + SSH read command live against cascadesDS.
- All reads OK; `ls <folder>` (FileStation list) is 407-denied for the admin
  account on this box (confirmed on-box as SYSTEM_ADMIN) -> now catches the
  400/407 and prints an SSH file-browse hint. `ls` share-roots still works.
- SSH backend (info/df/run + privileged synowebapi) verified.
- Documented MSYS path-mangling of bare `ls /path` arg on Windows.
- SKILL.md: per-command results; flagged write/setter path as not-yet-live.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/skills/synology/scripts/syno_client.py

@@ -338,8 +338,21 @@ def main(argv):
             _print(c.call("SYNO.Core.CurrentConnection", "list"))
         elif args.cmd == "ls":
             if args.path:
-                _print(c.call("SYNO.FileStation.List", "list", folder_path=args.path,
-                              additional='["size","owner","time","perm"]'))
+                try:
+                    _print(c.call("SYNO.FileStation.List", "list", folder_path=args.path,
+                                  additional='["size","owner","time","perm"]'))
+                except SynoError as e:
+                    # FileStation file-browsing (`list`) is denied for an account without
+                    # FileStation file privileges -- on-box it is 407, surfaced here as 400.
+                    # `list_share` (share roots) still works; for actual files use the SSH backend.
+                    if " 400" in str(e) or " 407" in str(e):
+                        raise SynoError(
+                            f"{e}\n  [HINT] FileStation file-listing is not permitted for this "
+                            f"account (built-in admin lacks FileStation file privileges on this "
+                            f"device). Use the SSH backend for real file browsing:\n"
+                            f"         bash .claude/skills/synology/scripts/syno-ssh.sh run "
+                            f"\"ls -la /volume1/<share>/<subpath>\" --confirm")
+                    raise
             else:
                 _print(c.call("SYNO.FileStation.List", "list_share",
                               additional='["size","owner","perm"]'))