feat(backend): card file attachments (issue 0128)

- migration 014_card_files: tabla con soft-delete + index activo
- handlers POST/GET/DELETE en backend/files.go
- routes /api/cards/{id}/files, /api/files/{id}
- limite 10MB, storage en uploads/<card_id>/<random>__<safe>

backend/migrations/014_card_files.sql

@@ -0,0 +1,16 @@
+-- Issue 0128: adjuntos de archivos por card.
+CREATE TABLE IF NOT EXISTS card_files (
+    id           TEXT PRIMARY KEY,
+    card_id      TEXT NOT NULL,
+    uploader_id  TEXT NOT NULL DEFAULT '',
+    filename     TEXT NOT NULL,
+    mime         TEXT NOT NULL DEFAULT '',
+    size         INTEGER NOT NULL DEFAULT 0,
+    stored_path  TEXT NOT NULL,
+    source       TEXT NOT NULL DEFAULT 'upload',
+    created_at   TEXT NOT NULL,
+    deleted_at   TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_card_files_card_active
+    ON card_files(card_id, deleted_at);