feat(12.2-02): add the fileupload field with deferred uploads committed on save

- type: fileupload compiles the D-08 keys and binds to the model's attach.Relation at boot
- X-Session-Key (cabana.SessionKeyHeader) carries the form session key; RecordInput.SessionKey
- GET and POST .../{id}/files/{field}: list with pending uploads, multipart upload into attach.Store
- the create and update save attaches the session's pending files in its transaction
- swagger2openapi folds formData parameters into a multipart requestBody
- admin OpenAPI, TS types, conformance cases, README and forms docs

modules/cabana/crud.go

@@ -22,9 +22,12 @@ type CRUDService struct {
 	DB *gorm.DB
 }
 
-// RecordInput is a decoded JSON object. Keys are untrusted.
+// RecordInput is a decoded JSON object. Keys are untrusted. SessionKey is
+// the form's X-Session-Key (SessionKeyHeader), empty when the request has
+// none: the save applies the file bindings held against it.
 type RecordInput struct {
-	Body map[string]any
+	Body       map[string]any
+	SessionKey string
 }
 
 // BulkDeleteInput is the bulk-delete body.
@@ -373,6 +376,9 @@ func (s CRUDService) save(ctx context.Context, cc *CompiledController, id any, i
 		if err := syncBelongsToMany(ctx, tx, cc, target, relations); err != nil {
 			return err
 		}
+		if err := s.commitDeferred(ctx, tx, cc, target, op, in); err != nil {
+			return err
+		}
 		if update {
 			err = formAfterUpdate(ctx, cc, target)
 		} else {