refactor(storage): move file management routes from user to admin namespace

- Remove file list, stats, download, and deletion routes from '/api/v1/upload'
- Move these endpoints under '/api/v1/admin/uploads'
- Remove user-specific filtering from files query and statistics to aggregate system-wide uploads by default
- Allow admins to bypass ownership check when downloading private files
- Update backend unit tests, Swagger documentation, and frontend service client and components

internal/router/router.go

@@ -214,11 +214,6 @@ func registerRoutes(r *gin.Engine) {
 			uploadRouter.Use(oauth.LoginRequired())
 			{
 				uploadRouter.POST("", upload.UploadFile)
-				uploadRouter.GET("/my", upload.ListMyFiles)
-				uploadRouter.GET("/stats", upload.GetFileStats)
-				uploadRouter.DELETE("/:id", upload.DeleteFile)
-				uploadRouter.GET("/download/:id", upload.DownloadFile)
-				uploadRouter.POST("/download/batch", upload.BatchDownloadFiles)
 			}
 
 			// Config (public)
@@ -282,7 +277,15 @@ func registerRoutes(r *gin.Engine) {
 				adminRouter.DELETE("/users/:id", admin_user.DeleteUser)
 
 				// Uploads
-				adminRouter.GET("/uploads/types", upload.GetDistinctUploadTypes)
+				adminUploadsRouter := adminRouter.Group("/uploads")
+				{
+					adminUploadsRouter.GET("", upload.ListFiles)
+					adminUploadsRouter.GET("/stats", upload.GetFileStats)
+					adminUploadsRouter.DELETE("/:id", upload.DeleteFile)
+					adminUploadsRouter.GET("/download/:id", upload.DownloadFile)
+					adminUploadsRouter.POST("/download/batch", upload.BatchDownloadFiles)
+					adminUploadsRouter.GET("/types", upload.GetDistinctUploadTypes)
+				}
 
 				// System Config
 				adminRouter.POST("/system-configs", system_config.CreateSystemConfig)