fix(import): upload browser files for local tasks

[HandSonic]

Uploads standard browser File objects through a bounded multipart endpoint while preserving the desktop path contract. Uses owner-only staging, atomic task/input journal events, durable tokenized cleanup markers and trusted-root recovery so accepted, rejected, canceled, failed, terminal, and restart paths clean safely. Includes JSDOM File/FormData, MockMvc endpoint, permission, journal, lifecycle, and restart tests.

Latest-main revalidation (2026-09-04)

• Rebased as one commit onto upstream 144a04e; current head 9adc500.
• Full backend modules passed: tools 68/68, domain-core 238/238, storage 58/58, web 92 passed plus 1 platform-specific skip.
• Targeted frontend ESLint, full Community prebuild, Umi/Webpack production build, and bundle verifier passed.
• Playwright on this branch verified real file selection, multipart filename/bytes/JSON fields, disabled submit while pending, and exactly one upload after repeated clicks; browser console had no errors.
• A separate on-wire Chromium FormData probe confirmed a concrete Content-Length header (411 bytes).

[HandSonic]

Exhaustive cross-PR integration update: the full 72-PR pairwise scan found the expected ArtifactService/test overlap among #2800, #2742, and #2802. I resolved it semantically in an isolated combined tree (atomic publication + durable deletion recovery + input cleanup), adapted the post-merge constructor/method signatures, and ran the full 9-module reactor: tools 68, domain-api 27, SPI 142, domain-core 256, storage 64, web 95 (1 environment skip), all with 0 failures/errors.