review findings:
- MessageBody: only http(s) and relative paths allowed for links;
data:image/* allowed for inline images. Rejects javascript:,
data:text/html, vbscript: which would execute via <a href>.
Unsafe matches fall back to plain text.
- files.go: remove unused fileID var generated then discarded.
- migration 014_card_files: tabla con soft-delete + index activo
- handlers POST/GET/DELETE en backend/files.go
- routes /api/cards/{id}/files, /api/files/{id}
- limite 10MB, storage en uploads/<card_id>/<random>__<safe>
egutierrez