fix(files): bind upload completion to signed path

[aiirvizionz]

Summary

• bind upload-complete storage paths to the authenticated user, conversation, and file id emitted by upload-url
• reject unrelated storage paths before any database or storage lookup
• add a regression test for the authorization boundary

Verification

• vitest run --config vitest.no-react.config.mjs
• 6 tests passed
• git diff --check