fix(upload): restrict cross-user private file access (UPLOAD-1)

- Add access_mode column to w_uploads table (0 = private, 1 = public) and initialize data in a single migration script
- Enforce strict ownership check for private files during download
- Allow public files to follow whitelisted public-access rules
- Default access_mode to public for avatars and private for generic uploads
- Update frontend service to support optional accessMode parameter

docs/docs.go

@@ -5196,6 +5196,9 @@ const docTemplate = `{
         "model.Upload": {
             "type": "object",
             "properties": {
+                "access_mode": {
+                    "type": "integer"
+                },
                 "created_at": {
                     "type": "string"
                 },

docs/swagger.json

@@ -5189,6 +5189,9 @@
         "model.Upload": {
             "type": "object",
             "properties": {
+                "access_mode": {
+                    "type": "integer"
+                },
                 "created_at": {
                     "type": "string"
                 },

docs/swagger.yaml

@@ -420,6 +420,8 @@ definitions:
     type: object
   model.Upload:
     properties:
+      access_mode:
+        type: integer
       created_at:
         type: string
       extension: