feat: implement document management module

- Backend (FastAPI):
  - Attachment and AttachmentVersion models with migration
  - FileStorageService with SHA-256 checksum validation
  - File type validation (whitelist/blacklist)
  - Full CRUD API with version control support
  - Audit trail integration for upload/download/delete
  - Configurable upload directory and file size limit

- Frontend (React + Vite):
  - AttachmentUpload component with drag & drop
  - AttachmentList component with download/delete
  - TaskAttachments combined component
  - Attachments service for API calls

- Testing:
  - 12 tests for storage service and API endpoints

- OpenSpec:
  - add-document-management change archived

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/app/models/__init__.py

@@ -12,9 +12,12 @@ from app.models.notification import Notification
 from app.models.blocker import Blocker
 from app.models.audit_log import AuditLog, AuditAction, SensitivityLevel, EVENT_SENSITIVITY, ALERT_EVENTS
 from app.models.audit_alert import AuditAlert
+from app.models.attachment import Attachment
+from app.models.attachment_version import AttachmentVersion
 
 __all__ = [
     "User", "Role", "Department", "Space", "Project", "TaskStatus", "Task", "WorkloadSnapshot",
     "Comment", "Mention", "Notification", "Blocker",
-    "AuditLog", "AuditAlert", "AuditAction", "SensitivityLevel", "EVENT_SENSITIVITY", "ALERT_EVENTS"
+    "AuditLog", "AuditAlert", "AuditAction", "SensitivityLevel", "EVENT_SENSITIVITY", "ALERT_EVENTS",
+    "Attachment", "AttachmentVersion"
 ]

backend/app/models/attachment.py

@@ -0,0 +1,31 @@
+import uuid
+from sqlalchemy import Column, String, Text, Integer, BigInteger, Boolean, DateTime, ForeignKey, Index
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+from app.core.database import Base
+
+
+class Attachment(Base):
+    __tablename__ = "pjctrl_attachments"
+
+    id = Column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
+    task_id = Column(String(36), ForeignKey("pjctrl_tasks.id", ondelete="CASCADE"), nullable=False)
+    filename = Column(String(255), nullable=False)
+    original_filename = Column(String(255), nullable=False)
+    mime_type = Column(String(100), nullable=False)
+    file_size = Column(BigInteger, nullable=False)
+    current_version = Column(Integer, default=1, nullable=False)
+    is_encrypted = Column(Boolean, default=False, nullable=False)
+    uploaded_by = Column(String(36), ForeignKey("pjctrl_users.id", ondelete="SET NULL"), nullable=True)
+    is_deleted = Column(Boolean, default=False, nullable=False)
+    created_at = Column(DateTime, server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    # Relationships
+    task = relationship("Task", back_populates="attachments")
+    uploader = relationship("User", foreign_keys=[uploaded_by])
+    versions = relationship("AttachmentVersion", back_populates="attachment", cascade="all, delete-orphan")
+
+    __table_args__ = (
+        Index("idx_attachment_task", "task_id", "is_deleted"),
+    )

backend/app/models/attachment_version.py

@@ -0,0 +1,26 @@
+import uuid
+from sqlalchemy import Column, String, Integer, BigInteger, DateTime, ForeignKey, Index
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+from app.core.database import Base
+
+
+class AttachmentVersion(Base):
+    __tablename__ = "pjctrl_attachment_versions"
+
+    id = Column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
+    attachment_id = Column(String(36), ForeignKey("pjctrl_attachments.id", ondelete="CASCADE"), nullable=False)
+    version = Column(Integer, nullable=False)
+    file_path = Column(String(1000), nullable=False)
+    file_size = Column(BigInteger, nullable=False)
+    checksum = Column(String(64), nullable=False)  # SHA-256
+    uploaded_by = Column(String(36), ForeignKey("pjctrl_users.id", ondelete="SET NULL"), nullable=True)
+    created_at = Column(DateTime, server_default=func.now(), nullable=False)
+
+    # Relationships
+    attachment = relationship("Attachment", back_populates="versions")
+    uploader = relationship("User", foreign_keys=[uploaded_by])
+
+    __table_args__ = (
+        Index("idx_version_attachment", "attachment_id", "version"),
+    )

backend/app/models/task.py

@@ -47,3 +47,4 @@ class Task(Base):
     # Collaboration relationships
     comments = relationship("Comment", back_populates="task", cascade="all, delete-orphan")
     blockers = relationship("Blocker", back_populates="task", cascade="all, delete-orphan")
+    attachments = relationship("Attachment", back_populates="task", cascade="all, delete-orphan")