fix(file)!: stream uploads through staged storage

- fix: replace multipart form parsing with streaming multipart reads and
  apply request body limits when max_upload_size is configured.
- refactor: route uploads through staging paths before promotion to
  long-term data paths, keeping incomplete uploads out of durable
  storage records.
- test: cover oversized uploads, unlimited uploads, staged cleanup, and
  local storage promotion boundaries.
- docs: document the staged upload model and multipart parent_id query
  parameter.

docs/roadmap.md

@@ -20,7 +20,7 @@ Package-level implementation order (each task includes unit tests):
 3. `internal/model` — domain types, error codes ✅
 4. `internal/api` — error response helpers ✅
 5. `internal/auth` — JWT utils ✅
-6. `internal/storage` — backend interface + local fs
+6. `internal/storage` — backend interface + local fs with staged upload promotion
 7. `internal/repository` — interfaces + GORM/SQLite impl ✅
 8. `internal/service` — auth, file, admin services ✅ (auth done)
 9. `internal/middleware` — logger, cors, auth ✅ (auth done)