feat: implement secure file upload system with JWT authentication

- Add JWT-based secure file access for local storage with 1-hour expiry
- Implement GORM repository methods for attachment CRUD operations
- Add secure file serving endpoint with token validation
- Update storage interface to support user context in URL generation
- Add comprehensive security features including path traversal protection
- Update documentation with security model and configuration examples
- Add utility functions for hex/byte conversion and UUID validation
- Configure secure file permissions (0600) for uploaded files

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/storage/local_test.go

@@ -72,8 +72,11 @@ func TestLocalStorage(t *testing.T) {
 		
 		url, err := storage.GetURL(path, time.Hour)
 		assert.NoError(t, err)
-		assert.Contains(t, url, path)
-		assert.Contains(t, url, config.BaseURL)
+		// New JWT token-based URLs should start with /secure-files and contain a token parameter
+		assert.Contains(t, url, "/secure-files")
+		assert.Contains(t, url, "token=")
+		// The token should be a JWT (contains dots for header.payload.signature)
+		assert.Contains(t, url, ".")
 	})
 	
 	t.Run("Delete File", func(t *testing.T) {