feat(files): add durable project uploads

[iamjr15]

Summary

• Persist uploaded documents, images, data, and code as durable project files instead of embedding file contents in prompts.
• Materialize uploads into each project's Daytona workspace so agents and later chats can reuse them.
• Add composer upload state, reusable project-file references, sandbox recovery, observability, and complete local setup documentation.

What's Included

Project file API and storage

• Adds authenticated upload and listing contracts with extension, size, batch, and file-signature validation.
• Stores durable copies in R2 and materializes them under /workspace/<project>/uploads/.
• Restores files when a sandbox is provisioned, replaced, or recovered.

Composer integration

• Adds upload progress and failure states to the home and thread composers.
• Replaces prompt-embedded file contents with stable project-relative references.
• Makes existing project files available through the composer reference menu.

Sandbox reliability

• Detects unhealthy workspace mounts and replaces affected sandboxes.
• Preserves uploads across chats, reloads, and sandbox lifecycle transitions.
• Improves structured upstream HTTP error reporting.

Local development

• Documents the supported Docker Compose stack, required credentials, troubleshooting, and direct browser QA workflow.
• Moves the local web endpoint to http://localhost:3001.

Architecture

The browser uploads a validated file through the gateway to the project-scoped sandbox Durable Object. The Durable Object writes a durable R2 copy and materializes the same bytes into the active Daytona project workspace. Composer references point to that workspace path, while provisioning and recovery rematerialize durable files when necessary.

Decisions Made

Decision	Choice	Reasoning
Durable source of truth	R2 with workspace materialization	Files survive sandbox replacement without storing binary data in Postgres.
Prompt representation	Project-relative paths	Avoids prompt bloat and lets agents use native document tooling.
Validation	Browser allowlist plus server signature checks	Provides fast feedback without trusting client MIME metadata.
Local port	3001	Matches the supported local environment and avoids the existing port collision.

Edge Cases Handled

Scenario	Handling
Empty, oversized, unsupported, or spoofed file	Reject before durable persistence.
Duplicate filename	Safely normalize and resolve the project path.
Missing or unhealthy workspace mount	Replace the sandbox and rematerialize durable project files.
Reload or later chat	Reuse the same stored project file without re-uploading.
Partial batch failure	Surface per-file progress and error state in the composer.

Verification

• pnpm typecheck
• pnpm lint
• pnpm turbo build --force under Node 22.22.2
• Direct browser upload and agent-read verification for TXT, CSV, PNG, Markdown, DOCX, PDF, PPTX, and XLSX
• SHA-256 equality between local fixtures and Daytona materialized files
• Files tree and rich preview verification for DOCX, PDF, PPTX, and XLSX
• Hard-reload persistence and clean browser console/service-log review