feat(server): add file route integration tests with ownership

enforcement

- test: cover authenticated register, login, upload, list, and download
  flow
- test: verify file API routes reject test identity header injection
- test: verify file API routes reject invalid, expired, and malformed
  tokens
- test: verify cross-user ownership isolation for all file CRUD
  operations
- refactor: rename test-only header constant to clarify it is not used
  in production

docs/server/roadmap.md

@@ -27,7 +27,7 @@ Package-level implementation order (each task includes unit tests):
 10. `internal/handler` — auth, account, file, admin handlers 🛠 (HTTP DTO mapping in place)
 11. `internal/server` — Gin router, route registration, graceful shutdown ✅
 12. `cmd/serve.go`, `cmd/config.go`, `cmd/status.go` ✅ (serve done)
-13. Integration tests 🛠 (authenticated register → login → upload → list → download route flow covered with a small file)
+13. Integration tests 🛠 (authenticated register → login → upload → list → download route flow covered with a small file; file API authentication bypass, invalid token, and cross-user isolation boundaries covered)
 14. Architecture boundary tests ✅
 
 ## Future