feat(api): CRUD files/folders + upload multipart réels (scope owner, soft-delete, conteurs d'erreurs)

- repository.Resources (insert/list/get/soft-delete scoping owner_id, UNIQUE(parent_id,name) → NAME_CONFLICT) + Devices.Upsert au register
- service.Resources : DTOs {id,name,size,mimeType,folderId,createdAt,updatedAt}, upload → UPLOAD_DIR/<device>/<id>.<ext> (nettoyage si métadonnée échoue)
- handlers : files list/get/delete/upload + folders racines ; routes consolidées dans handlers.RegisterRoutes
- dbtest package : test DB jetée par repo (open+reset+migrate, skip si PG down) ; tests repository + handlers end-to-end (register→token→CRUD, scoping cross-device, FILE_TOO_LARGE, NAME_CONFLICT)
- docs: /devices persiste le device, layout UPLOAD_DIR par device, codes NAME_CONFLICT/SERVICE_UNAVAILABLE

backend/handlers/store.go

@@ -0,0 +1,28 @@
+package handlers
+
+import (
+	"errors"
+
+	"github.com/gin-gonic/gin"
+	"github.com/vaultdrop/backend/pkg/api"
+	"github.com/vaultdrop/backend/repository"
+	"github.com/vaultdrop/backend/service"
+)
+
+// Store is the business layer used by handlers; set once at startup
+// (cmd/server). Nil until then.
+var Store *service.Resources
+
+// writeError maps repository/service sentinels to contract error codes.
+func writeError(c *gin.Context, err error) {
+	switch {
+	case errors.Is(err, repository.ErrNotFound):
+		api.Error(c, 404, "NOT_FOUND", "resource not found")
+	case errors.Is(err, repository.ErrNameConflict):
+		api.Error(c, 409, "NAME_CONFLICT", "a resource with this name already exists here")
+	case errors.Is(err, service.FileTooLargeError):
+		api.Error(c, 413, "FILE_TOO_LARGE", "file exceeds the maximum allowed size")
+	default:
+		api.Error(c, 500, "INTERNAL", err.Error())
+	}
+}