feat(evidence): add file upload/download API endpoints with tests

- POST /uploads: multipart upload with content-type/size validation, per-session limits, S3 storage
- GET /uploads/{id}/url: presigned download URL with account ownership check
- GET /uploads: list uploads for a session
- DELETE /uploads/{id}: delete with ownership enforcement (403 for non-owners)
- Returns 503 gracefully when STORAGE_ENDPOINT is not configured
- 15 integration tests covering auth, validation, 503 behavior, and ownership

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/api/router.py

@@ -27,6 +27,7 @@ from app.api.endpoints import flowpilot_analytics
 from app.api.endpoints import notifications
 from app.api.endpoints import public_templates
 from app.api.endpoints import admin_gallery
+from app.api.endpoints import uploads
 
 api_router = APIRouter()
 
@@ -79,3 +80,4 @@ api_router.include_router(flowpilot_analytics.router)
 api_router.include_router(notifications.router)
 api_router.include_router(public_templates.router)
 api_router.include_router(admin_gallery.router)
+api_router.include_router(uploads.router)