feat: patient & lab file attachments (real backend storage)

Add a real file-storage layer to the backend and wire upload UI into the
frontend.

backend:
- new `attachments` table (org-scoped, links to a patient file number and
  optionally a lab result) + Drizzle migration
- `/api/attachments` route: upload (multer → disk under UPLOAD_DIR),
  list, stream/download, delete; gated by patient:write OR lab:write via
  a new requireAnyPermission helper so lab staff can attach analyses
- UPLOAD_DIR env (default ./uploads) + a persistent docker volume

frontend:
- lib/attachments.ts client (multipart upload, list, delete, preview URL)
- staged file picker in the patient Add/Edit dialog (uploaded after save)
  and the lab Add-result dialog (linked to the result)
- a Files section in the patient sheet that lists attachments and opens
  them in a preview dialog (images inline, others via download)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/.env.example

@@ -9,6 +9,10 @@ BETTER_AUTH_SECRET=replace-me-with-openssl-rand-base64-32
 # Public base URL of THIS backend (used for auth callbacks & cookies).
 BETTER_AUTH_URL=http://localhost:4000
 
+# Directory for uploaded patient/lab files. Defaults to ./uploads in local dev;
+# in Docker it's a persistent volume (see docker-compose.yml).
+UPLOAD_DIR=./uploads
+
 # --- AI ------------------------------------------------------------------
 # Key used to encrypt at-rest AI provider API keys (per-user, set in the app's
 # Settings → AI). Generate one: openssl rand -base64 32. Rotating it forces