Implement secure file upload pipeline for capsule image attachments

[nottherealalanturing]

Description

The MVP needs at least one media type beyond plain text. Image attachments are the most hackathon-feasible option.

Scope

• Add upload endpoint and storage abstraction
• Support image validation, size limits, and metadata persistence
• Connect attachment records to capsules
• Review key files: apps/api/src/modules/uploads/**, capsule models/services

Acceptance Criteria

• Sender can upload a supported image and attach it to a draft
• Locked recipient views do not expose attachment contents prematurely
• Unsupported file types are rejected cleanly

Dependencies

Blocked by: Phase 1 capsule CRUD and auth issues

Stack

Next.js / Express