Dateien

Uploads nutzen Presign, direkten Objektspeicher-Upload und Confirm. Die API akzeptiert keine rohen Datei-Bodies direkt.

Endpunkt	Body/Parameter	Berechtigung
`POST /files/presign`	`fileName, contentType, sizeBytes, kind, subjectId, contractId, paymentId`	`contract_view view`
`PUT signed upload URL`	`file bytes to object storage`	`signed URL`
`POST /files/confirm`	`objectKey, fileName, contentType, sizeBytes, kind, uploadToken`	`contract_view view`
`GET /files/:id/download`	`contractId, paymentId`	`contract_view view`