Enhance upload handling: add db-backed upload rate limiting and lease management, enforce stricter validation for deployment configurations, optimize test suite and retired functionality, and improve input handling and error recovery.

src/db/attachments.js

@@ -27,6 +27,12 @@ export function initializeAttachments(db) {
             PRIMARY KEY (attachment_id, vision_model, prompt_version, question)
         );
         CREATE TABLE IF NOT EXISTS upload_deletions (storage_key TEXT PRIMARY KEY);
+        CREATE TABLE IF NOT EXISTS upload_leases (
+            token TEXT PRIMARY KEY,
+            username TEXT NOT NULL REFERENCES users(username) ON DELETE CASCADE,
+            created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+        );
+        CREATE INDEX IF NOT EXISTS upload_leases_user ON upload_leases(username);
         CREATE TRIGGER IF NOT EXISTS release_message_attachment AFTER DELETE ON message_attachments
         BEGIN
             DELETE FROM attachments WHERE id = OLD.attachment_id AND status = 'attached'