enforcement
- test: cover authenticated register, login, upload, list, and download
flow
- test: verify file API routes reject test identity header injection
- test: verify file API routes reject invalid, expired, and malformed
tokens
- test: verify cross-user ownership isolation for all file CRUD
operations
- refactor: rename test-only header constant to clarify it is not used
in production
- test: exercise register, login, empty listing, small-file upload, updated listing, and authenticated download through the HTTP router.
- docs: mark the small-file integration flow as covered in the server roadmap.
- docs: move server docs to docs/server/ and update all cross-references
- docs: move web-roadmap.md to docs/web/roadmap.md and create
docs/web/decisions.md
- docs: update AGENTS.md with separate Server and Web sections
ld