🔒️(backend) prevnt file change post checks

Before this commit, post a file check, the policy could be
reused to change the verified file.
Now, files are uplaoded to a temporary location, then inside
a transaction that prevents concurrent calls, the file is
copied to its final destination and the checks are run on that one.
A new file can still be updated with the policy but it will never be read, etc.

As part of this change, all files in the new tmp directory
on s3 should have an expiration policy.

CHANGELOG.md

@@ -17,6 +17,7 @@ and this project adheres to
 ### Fixed
 
 - 🐛(backend) prevent duplicate pending users on concurrent requests
+- 🔒️(backend) prevent file change post checks #1377
 
 ## [1.17.0] - 2026-05-31
 
@@ -30,7 +31,7 @@ and this project adheres to
 - ✨(backend) add core.recording.event.parsers.S3Parser
 - ✨(summary) extended support for all video / audio files #1358
 
-### Changed 
+### Changed
 
 - ♻️(fullstack) simplify source serialization
 - ✨(backend) expose room configuration to all API consumers
@@ -40,6 +41,7 @@ and this project adheres to
 - ♻️(backend) prefix Swagger routes with /api
 
 ### Fixed
+
 - 🩹(backend) fix swagger and redoc documentation URLs
 
 ## [1.16.0] - 2026-05-13