feat(12.2-02): add file removal, caption, reorder and protected downloads

- DELETE, PUT and POST reorder under .../{id}/files/{field}, each scoped by one parent query (404 for a foreign file)
- protected download and thumb routes: is_public=false only, nosniff, private no-store, sandbox CSP, inline only for jpeg/png/gif/webp
- the save applies deferred removals, replaces attachOne files and rechecks maxFiles and required
- blobs of deleted files are removed after commit
- swagger2openapi emits binary content for file responses
- admin OpenAPI, TS types, conformance, README and attachments docs

modules/cabana/http.go

@@ -279,6 +279,16 @@ func (s *service) mount(r pact.Router) {
 		// record being created in the X-Session-Key session.
 		g.Post("/{vendor}/{plugin}/{controller}/{id}/files/{field}", requireAjax(s.fileUpload))
 		constrainFile(g)
+		g.Post("/{vendor}/{plugin}/{controller}/{id}/files/{field}/reorder", requireAjax(s.fileReorder))
+		constrainFile(g)
+		g.Put("/{vendor}/{plugin}/{controller}/{id}/files/{field}/{file}", requireAjax(s.fileUpdate))
+		constrainFileID(g)
+		g.Delete("/{vendor}/{plugin}/{controller}/{id}/files/{field}/{file}", requireAjax(s.fileRemove))
+		constrainFileID(g)
+		g.Get("/{vendor}/{plugin}/{controller}/{id}/files/{field}/{file}/download", s.fileDownload)
+		constrainFileID(g)
+		g.Get("/{vendor}/{plugin}/{controller}/{id}/files/{field}/{file}/thumb", s.fileThumb)
+		constrainFileID(g)
 	})
 	// The SPA shell: public, no guard. ServeMux prefers every API pattern
 	// above over the {path...} wildcard.
@@ -309,6 +319,11 @@ func constrainFile(g pact.Router) {
 	g.Where("field", "[A-Za-z_][A-Za-z0-9_]*")
 }
 
+func constrainFileID(g pact.Router) {
+	constrainFile(g)
+	g.Where("file", "[0-9]+")
+}
+
 func constrainNested(g pact.Router) {
 	constrainController(g)
 	g.Where("segment", "[A-Za-z_][A-Za-z0-9_]*")
@@ -787,7 +802,7 @@ func (s *service) crud() (CRUDService, error) {
 	if err != nil {
 		return CRUDService{}, err
 	}
-	return CRUDService{DB: db}, nil
+	return CRUDService{DB: db, bucket: s.bucket(), tr: s.translator()}, nil
 }
 
 func (s *service) list(w http.ResponseWriter, r *http.Request) {