feat(gateway): 图片上传端点(B1) — POST /v1/upload + GET /v1/files/{name}

- upload.go: multipart上传(owner/admin+审计)→ {url,size,mime,name}; MaxBytesReader 5MB + DetectContentType嗅探 + 白名单raster(拒SVG/HTML) + crypto/rand 128-bit随机名 + 0700目录
- 静态服务: 同端口 GET /v1/files/{name}, 能力URL, 路径穿越全形态拒绝(.. / %2f / %2e%2e), nosniff, Range
- errors: ErrPayloadTooLarge(413)/ErrUnsupportedMediaType(415)
- server.go 路由+Deps.DataDir; wire.go resolveDataDir 注入
- 8测试+真实二进制E2E, build/vet/test绿+交叉编译
- Docs/api-client v0.24 + api-reference §0.3 同步

cmd/cyrene/wire.go

@@ -684,6 +684,7 @@ func (a *app) wireFrontend() error {
 		Frontend:       resolveFrontendFS(a.log),
 		Webhooks:       a.channelBridge.WebhookHandlers(),
 		DatabasePath:   a.dbPath,
+		DataDir:        resolveDataDir(a.cfg),
 	})
 	if err != nil {
 		return fmt.Errorf("gateway: %w", err)