Updated file-upload.md to also add a note of when this part is relevant

Author: PaddyS

symfony/file-upload.md

@@ -491,17 +491,23 @@ If you're not using `autowiring` and `autoconfiguring`, don't forget to register
 
 For resolving the file URL, you can use a custom normalizer, like shown in [the previous example](#resolving-the-file-url).
 
-## Uploading Files on Your User Entity
+### Uploading Files on your User Entity
 
-If you’d like to add file-upload support directly to your `User` entity (rather than a dedicated `MediaObject`), there’s one extra “gotcha” you must handle:
-Symfony’s session storage will try to serialize your entire `User` object (including any `File` instance you’ve attached), and `File` is not serializable by default.
+If you’d like to add file-upload support directly to your `User` entity (rather than a dedicated `MediaObject`), there’s one extra “gotcha” you may have to take care of.
+
+> [!NOTE]
+> If you only expose file uploads through API Platform’s endpoints (e.g. POST /media_objects or POST /users/{id}/avatar), you don’t need any special serialization hooks and you can ignore this part.
+> This part is only relevant if you try to attach an `UploadedFile` or `File` object directly to your `User` entity in a non-API context (for example via a Symfony form controller where the `User` is stored in the session).
+
+Symfony’s session handler will attempt to serialize the entire `User` object when it stores your `User` in the session (for example via the Security token in a Symfony form controller).
+Since `File` is not serializable by default, you’ll encounter:
 
 To avoid PHP errors like:
 ```
 Serialization of 'Symfony\Component\HttpFoundation\File\File' is not allowed
 ```
 
-you need to implement both the old `\Serializable` interface **and**, depending on the PHP version, the new `__serialize()` / `__unserialize()` magic methods on your `User`, limiting serialization to just scalar fields (`id`, `email`, `password`, etc.).
+To fix this, you need to implement both the old `\Serializable` interface **and**, starting with PHP 7.4+, the new `__serialize()` / `__unserialize()` magic methods on your `User`, limiting serialization to just scalar fields (`id`, `email`, `password`, etc.).
 Symfony will then happily keep your `User` in the session while VichUploaderBundle handles the file itself.
 
 ```php