feat(core): upload files to a chat, and serve them back

[davemooreuws]

First of seven PRs for chat attachments: storage and routes. Nothing in the web app uses them yet, and attaching an upload to a message comes next.

• thread_file gains kind, name, uploader_id, message_id and position, in one migration that fills in existing rows as tool results before dropping kind's default. The migration also allows the agent_attachment kind that feat(core): let a bot share a file from its sandbox in its reply #423 uses, so the stack has one migration.
• POST /chats/:chatId/files?name=…&type=… streams up to 30 MB into the chat's main thread. Without a type, the type comes from the name. A person can have at most 20 uploads not yet sent.
• GET /chats/:chatId/files/:fileId shows common images in place and offers everything else as a download, with nosniff and Content-Security-Policy: sandbox.
• An upload can't be read, by people or bots, until it's attached to a message. Uploads never attached are removed after 24 hours.

Part of SUGA-1825

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	sugabots-website	dfc6b3f	Oct 16 2026, 06:45 AM

original issue addressed