enforcement
- test: cover authenticated register, login, upload, list, and download
flow
- test: verify file API routes reject test identity header injection
- test: verify file API routes reject invalid, expired, and malformed
tokens
- test: verify cross-user ownership isolation for all file CRUD
operations
- refactor: rename test-only header constant to clarify it is not used
in production
