Feature/secure file upload

[AdityaPaneru]

Summary

Adds file upload security scanning using pompelmi + ClamAV before any
file is written to disk or committed to the database.

Closes #2169

Changes

New files

• src/files/infrastructure/uploader/scan/file-scan.service.ts — shared FileScanService using pompelmi scanBuffer with ClamAV

Modified files

• src/files/infrastructure/uploader/local/files.module.ts — switched to memoryStorage, added FileScanService to providers
• src/files/infrastructure/uploader/local/files.service.ts — scans buffer before writing to disk, only writes to disk if scan passes
• src/files/infrastructure/uploader/s3-presigned/files.module.ts — switched to memoryStorage, added FileScanService to providers
• src/files/infrastructure/uploader/s3-presigned/files.service.ts — create() now points presigned URL to quarantine bucket, added confirmUpload() which scans and promotes to production bucket
• src/files/infrastructure/uploader/s3-presigned/files.controller.ts — added POST /files/confirm endpoint
• src/files/infrastructure/uploader/s3-presigned/dto/file-confirm.dto.ts — new DTO for confirm endpoint
• docs/file-uploading.md — added scanning documentation with mermaid flow diagrams
• env-example-relational — added AWS_DEFAULT_S3_BUCKET_QUARANTINE, CLAMAV_HOST, CLAMAV_PORT

How it works

Local driver

1. File lands in memory via multer memoryStorage
2. Buffer is scanned via ClamAV
3. If clean: written to disk and DB record saved
4. If malicious or scan error: 422 returned, nothing touches disk

S3 presigned driver

1. POST /files/upload returns presigned URL pointing to quarantine bucket
2. Client uploads directly to quarantine bucket
3. POST /files/confirm downloads from quarantine and scans the buffer
4. If clean: promoted to production bucket, DB record saved
5. If malicious or scan error: deleted from quarantine, 422 returned

What it catches

• Malware and virus signatures via ClamAV
• Fails closed — upload rejected if ClamAV is unreachable

Prerequisites

ClamAV must be running:

docker run -d --name clamav -p 3310:3310 clamav/clamav:stable

Testing

• yarn build passes with 0 errors
• yarn lint passes with 0 errors