feat(m10): file sharing with upload, lightbox, permission, tests, e2e

- FileRepository (CRUD, soft-delete, pagination, project isolation) +
  FileStorageService (local FS save data/uploads/<projectId>/<uuid>.<ext>,
  MIME allowlist, filename sanitize, unique uuid name, member permission,
  file_shared notification to other members, file_uploaded activity log,
  SSE file.uploaded, uploader/admin delete + FS unlink)
- APIs: files list/upload(multipart), download (membership), delete
- Screens: files page + Uploader(multipart) + FileList(image Lightbox,
  PDF link, delete), ProjectNav ファイル link
- Unit tests (FileRepository, FileStorageService) + e2e file-sharing

tests/unit/repositories/FileRepository.test.ts

@@ -0,0 +1,88 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { createMigratedTestDb } from '@/tests/helpers/db';
+import type { SqliteDatabase } from '@/lib/db/sqlite';
+import { UserRepository } from '@/repositories/UserRepository';
+import { ProjectRepository } from '@/repositories/ProjectRepository';
+import { ProjectMemberRepository } from '@/repositories/ProjectMemberRepository';
+import { FileRepository } from '@/repositories/FileRepository';
+
+describe('FileRepository', () => {
+  let db: SqliteDatabase;
+  let repo: FileRepository;
+  let projectId: number;
+  let userId: number;
+
+  beforeEach(() => {
+    db = createMigratedTestDb();
+    repo = new FileRepository(db);
+    userId = new UserRepository(db).create({
+      name: 'U',
+      email: 'u@example.com',
+      passwordHash: 'h',
+    }).id;
+    projectId = new ProjectRepository(db).create({
+      name: 'P',
+      ownerId: userId,
+    }).id;
+    new ProjectMemberRepository(db).add(projectId, userId, 'admin');
+  });
+
+  afterEach(() => db.close());
+
+  function createFile(name: string) {
+    return repo.create({
+      projectId,
+      uploaderId: userId,
+      filename: `${name}.bin`,
+      originalName: name,
+      mimeType: 'application/octet-stream',
+      size: 10,
+      path: `/tmp/${name}.bin`,
+    });
+  }
+
+  it('creates and finds a file', () => {
+    const f = createFile('test');
+    expect(repo.findFileById(f.id)?.originalName).toBe('test');
+  });
+
+  it('lists files newest first with total', () => {
+    createFile('a');
+    createFile('b');
+    const { items, total } = repo.findFilesByProject(projectId);
+    expect(total).toBe(2);
+    expect(items[0].originalName).toBe('b');
+  });
+
+  it('excludes soft-deleted files', () => {
+    const f = createFile('a');
+    repo.delete(f.id);
+    expect(repo.findFileById(f.id)).toBeNull();
+    expect(repo.findFilesByProject(projectId).total).toBe(0);
+  });
+
+  it('isolates files by project', () => {
+    createFile('mine');
+    const p2 = new ProjectRepository(db).create({
+      name: 'P2',
+      ownerId: userId,
+    }).id;
+    repo.create({
+      projectId: p2,
+      uploaderId: userId,
+      filename: 'x.bin',
+      originalName: 'theirs',
+      mimeType: 'application/octet-stream',
+      size: 1,
+      path: '/tmp/x.bin',
+    });
+    expect(repo.findFilesByProject(projectId).total).toBe(1);
+    expect(repo.findFilesByProject(p2).total).toBe(1);
+  });
+
+  it('paginates files', () => {
+    for (let i = 0; i < 5; i++) createFile(`f${i}`);
+    expect(repo.findFilesByProject(projectId, 1, 2).items).toHaveLength(2);
+    expect(repo.findFilesByProject(projectId, 1, 2).total).toBe(5);
+  });
+});