feat: implement secure file upload system with JWT authentication

- Add JWT-based secure file access for local storage with 1-hour expiry
- Implement GORM repository methods for attachment CRUD operations
- Add secure file serving endpoint with token validation
- Update storage interface to support user context in URL generation
- Add comprehensive security features including path traversal protection
- Update documentation with security model and configuration examples
- Add utility functions for hex/byte conversion and UUID validation
- Configure secure file permissions (0600) for uploaded files

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/storage/s3.go

@@ -155,6 +155,12 @@ func (s *S3Storage) GetURL(path string, expiry time.Duration) (string, error) {
 	return url, nil
 }
 
+// GetURLWithContext returns a presigned URL for accessing the file (S3 doesn't use user context)
+func (s *S3Storage) GetURLWithContext(path string, expiry time.Duration, userID, orgID string) (string, error) {
+	// For S3, user context is not needed as presigned URLs are cryptographically secure
+	return s.GetURL(path, expiry)
+}
+
 // Exists checks if a file exists in S3
 func (s *S3Storage) Exists(path string) (bool, error) {
 	input := &s3.HeadObjectInput{