Private large-file sharing added to support tickets

SCComp support tickets now include administrator-controlled private file sharing. Uploads remain disabled by default and become available only after an administrator enables them for a specific ticket. This makes it possible to exchange ISO images, diagnostic archives, screenshots, and other support material without publishing a storage URL.

Files can be up to 10 GiB each, with up to 20 files and 50 GiB per ticket. The browser transfers large files in resumable 16 MiB chunks, retries temporary failures, and can continue an interrupted upload for 24 hours when the same file is selected again.

Every operation rechecks ticket authorization. Stored objects use random names outside the public web root, downloads are attachment-only, and nginx serves authorized full and byte-range responses after the application approves access. Administrators can disable additional uploads or permanently remove files. The production release passed 48 automated tests and live upload, complete-download, resumed-range, and unauthorized-access checks.

An hourly sandboxed cleanup job enforces the resume window and reclaims expired or orphaned temporary chunks automatically.

Public upload compatibility fix

The first real ISO attempt exposed a public-edge mismatch: resumable chunks were sent as raw request bodies, so the security gateway applied its intentionally small non-file body limit and rejected the first chunk with HTTP 413 before it reached the application.

Chunks now use a single protected multipart file part while retaining the same 16 MiB size, exact offsets, authorization, CSRF checks, retry behavior, and private storage. The correction passed all 49 automated tests and a real 16 MiB end-to-end transfer through the public WAF, nginx, application, database, and storage sandbox. Interrupted sessions remain resumable by selecting the same file again.