feat(intake): upload a request and enqueue processing atomically

[Fluory]

Goal

A clerk uploads an e-mail or loose documents. The system stores the originals privately, creates the request and its documents (status NEW) and enqueues processing in the same transaction; exact duplicates are flagged, never discarded.

Acceptance criteria

• Upload accepts .eml, .msg, .pdf, .xlsx, .docx up to a configured size; other types are rejected with a clear message
• Originals are stored under {companyId}/{requestId}/{documentId} in a private bucket; download only through an authenticated route with tenant check
• Request, documents and the pg-boss job are committed in one transaction – a failure after the insert rolls back all three
• Same Message-ID or same SHA-256 set within the company → request flagged as possible duplicate
• Upload is recorded as an audit event

Not part of this task

• Mailbox import, near-duplicate hints, the processing itself

Affected areas

• src/features/intake/
• src/features/documents/
• src/features/storage/
• src/features/audit/

Test plan

Criterion	Check
atomic create + enqueue	integration test with forced failure
duplicate fingerprint	unit test
private access	integration test: other tenant gets 404

Security/Privacy affected?

Yes – file upload (size/type limits), tenant-scoped storage paths, no public URLs.

Epic: #2 · Architecture: docs/decisions/ADR-0001-pilot-architecture.md

[Fluory]

Claimed by @Fluory (Claude Code cloud session, overnight run) on branch claude/feat-intake-upload-5 – stacked on claude/feat-identity-tenancy-4 (#31). Draft PR follows.

---

Generated by Claude Code

[Fluory]

decision-needed – two accepted risks were entered in the exceptions register (docs/technical/architecture.md) with you as owner; please accept or reject them (PR #32):

1. No per-user rate limit on POST /api/requests in the pilot. Mitigation: only signed-in staff; body bounded before reading (Content-Length required, UPLOAD_MAX_REQUEST_BYTES). Expires: before any public deployment (epic: public showcase #19).
2. .msg checked by OLE signature only (no Outlook-structure validation). Mitigation: served only as attachment with nosniff; parsed later by the stateless AI service. Expires: with feat(ai-service): XLSX, DOCX, MSG and scanned PDFs #23 (MSG parsing). Related limitation: .msg Message-ID is not read yet, so .msg duplicates are only caught by identical bytes.

Also chosen without an explicit rule: upload limits 20 MiB/file, 10 files, 40 MiB/request (configurable).

---

Generated by Claude Code