feat(12.2-02): add file removal, caption, reorder and protected downloads

- DELETE, PUT and POST reorder under .../{id}/files/{field}, each scoped by one parent query (404 for a foreign file)
- protected download and thumb routes: is_public=false only, nosniff, private no-store, sandbox CSP, inline only for jpeg/png/gif/webp
- the save applies deferred removals, replaces attachOne files and rechecks maxFiles and required
- blobs of deleted files are removed after commit
- swagger2openapi emits binary content for file responses
- admin OpenAPI, TS types, conformance, README and attachments docs

modules/cabana/security_coverage_test.go

@@ -64,6 +64,11 @@ var phase09Routes = []adminRoute{
 	{key: "POST /{vendor}/{plugin}/{controller}/{id}/relations/{name}/unlink"},
 	{key: "GET /{vendor}/{plugin}/{controller}/{id}/files/{field}", mounted: nestedGetRoute},
 	{key: "POST /{vendor}/{plugin}/{controller}/{id}/files/{field}"},
+	{key: "POST /{vendor}/{plugin}/{controller}/{id}/files/{field}/reorder"},
+	{key: "PUT /{vendor}/{plugin}/{controller}/{id}/files/{field}/{file}"},
+	{key: "DELETE /{vendor}/{plugin}/{controller}/{id}/files/{field}/{file}"},
+	{key: "GET /{vendor}/{plugin}/{controller}/{id}/files/{field}/{file}/download"},
+	{key: "GET /{vendor}/{plugin}/{controller}/{id}/files/{field}/{file}/thumb"},
 	{key: "GET /assets/{vendor}/{plugin}/{file...}", public: true, spa: true},
 	{key: "GET ", public: true, spa: true},
 	{key: "GET /{path...}", public: true, spa: true},
@@ -290,6 +295,11 @@ func phase09ProtectedCalls() []phase09Call {
 		{"relation-unlink", (*service).relationUnlink},
 		{"file-list", (*service).fileList},
 		{"file-upload", (*service).fileUpload},
+		{"file-reorder", (*service).fileReorder},
+		{"file-update", (*service).fileUpdate},
+		{"file-remove", (*service).fileRemove},
+		{"file-download", (*service).fileDownload},
+		{"file-thumb", (*service).fileThumb},
 		{"settings-schema", (*service).settingsSchema},
 		{"settings-get", (*service).settingsGet},
 		{"settings-put", (*service).settingsPut},