fix(upload): restrict cross-user private file access (UPLOAD-1)

- Add access_mode column to w_uploads table (0 = private, 1 = public) and initialize data in a single migration script
- Enforce strict ownership check for private files during download
- Allow public files to follow whitelisted public-access rules
- Default access_mode to public for avatars and private for generic uploads
- Update frontend service to support optional accessMode parameter

internal/model/uploads.go

@@ -43,6 +43,7 @@ type Upload struct {
 	StorageDriver string         `json:"storage_driver" gorm:"size:50;not null"`         // 存储引擎驱动 (如 local, s3, oss)
 	Type          string         `json:"type" gorm:"column:type;size:50;not null;index"` // 业务标识类型 (如 avatar, doc, attachment)
 	Status        UploadStatus   `json:"status" gorm:"type:varchar(20);not null"`        // 状态
+	AccessMode    int            `json:"access_mode" gorm:"column:access_mode;not null;default:0"`
 	Metadata      UploadMetadata `json:"metadata" gorm:"serializer:json;type:jsonb"`     // 业务扩展元数据
 	CreatedAt     time.Time      `json:"created_at" gorm:"autoCreateTime"`
 	UpdatedAt     time.Time      `json:"updated_at" gorm:"autoUpdateTime"`