feat: patient & lab file attachments (real backend storage)

Add a real file-storage layer to the backend and wire upload UI into the
frontend.

backend:
- new `attachments` table (org-scoped, links to a patient file number and
  optionally a lab result) + Drizzle migration
- `/api/attachments` route: upload (multer → disk under UPLOAD_DIR),
  list, stream/download, delete; gated by patient:write OR lab:write via
  a new requireAnyPermission helper so lab staff can attach analyses
- UPLOAD_DIR env (default ./uploads) + a persistent docker volume

frontend:
- lib/attachments.ts client (multipart upload, list, delete, preview URL)
- staged file picker in the patient Add/Edit dialog (uploaded after save)
  and the lab Add-result dialog (linked to the result)
- a Files section in the patient sheet that lists attachments and opens
  them in a preview dialog (images inline, others via download)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/docker-compose.yml

@@ -52,6 +52,8 @@ services:
       FRONTEND_URL: http://localhost:3000
       PORT: "4000"
       NODE_ENV: production
+      # Uploaded patient/lab files live here, on the temetro_uploads volume.
+      UPLOAD_DIR: /var/lib/temetro/uploads
       SMTP_HOST: ${SMTP_HOST:-}
       SMTP_PORT: ${SMTP_PORT:-}
       SMTP_USER: ${SMTP_USER:-}
@@ -60,6 +62,8 @@ services:
     volumes:
       # Persists auto-generated secrets so they stay stable across restarts.
       - temetro_secrets:/var/lib/temetro
+      # Persists uploaded files across restarts/rebuilds.
+      - temetro_uploads:/var/lib/temetro/uploads
     ports:
       - "4000:4000"
 
@@ -88,3 +92,4 @@ services:
 volumes:
   temetro_pgdata:
   temetro_secrets:
+  temetro_uploads: