refactor: add AppError helpers and harden upload/download error handling

- refactor: replace inline AppError literals with model.New*Error
  constructors in service and handler layers
- feat: PromoteStaged falls back to copy/delete when os.Rename returns
  EXDEV (cross-device link)
- fix: upload error messages no longer leak internal multipart field
  names or parser implementation details
- fix: upload size violations are converted to domain error
  ErrUploadTooLarge at the handler boundary
- fix: download logs error and size mismatch when io.Copy fails or
  writes fewer bytes than expected
- test: add tests for field name leak prevention, parser error
  sanitization, read errors after response start, and EXDEV fallback

internal/storage/local_test.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"os"
 	"strings"
+	"syscall"
 	"testing"
 )
 
@@ -179,6 +180,50 @@ func TestPromoteRequiresDataFinalPrefix(t *testing.T) {
 	}
 }
 
+func TestPromoteStagedFallsBackToCopyOnEXDEV(t *testing.T) {
+	dir := t.TempDir()
+	store, err := NewLocalStorage(dir)
+	if err != nil {
+		t.Fatalf("NewLocalStorage: %v", err)
+	}
+	ctx := context.Background()
+
+	content := "copy across filesystems"
+	_, err = store.SaveStaged(ctx, "staging/cross-device.txt", strings.NewReader(content))
+	if err != nil {
+		t.Fatalf("SaveStaged: %v", err)
+	}
+
+	originalRename := renameLocalFile
+	renameLocalFile = func(_, _ string) error {
+		return &os.LinkError{Op: "rename", Err: syscall.EXDEV}
+	}
+	t.Cleanup(func() {
+		renameLocalFile = originalRename
+	})
+
+	if err := store.PromoteStaged(ctx, "staging/cross-device.txt", "data/cross-device.txt"); err != nil {
+		t.Fatalf("PromoteStaged: %v", err)
+	}
+
+	reader, err := store.Open(ctx, "data/cross-device.txt")
+	if err != nil {
+		t.Fatalf("Open promoted file: %v", err)
+	}
+	got, err := io.ReadAll(reader)
+	reader.Close()
+	if err != nil {
+		t.Fatalf("ReadAll: %v", err)
+	}
+	if string(got) != content {
+		t.Errorf("content = %q, want %q", string(got), content)
+	}
+
+	if _, err := os.Stat(dir + "/staging/cross-device.txt"); !os.IsNotExist(err) {
+		t.Errorf("staged file should be removed after fallback promote, stat err = %v", err)
+	}
+}
+
 func TestOpenMissingFile(t *testing.T) {
 	dir := t.TempDir()
 	store, err := NewLocalStorage(dir)