feat: file upload, allowlist, and download/preview

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_items.py

@@ -68,3 +68,34 @@ def test_title_from_first_line(client):
 def test_explicit_title(client):
     r = client.post("/api/items", json={"body": "body text", "title": "Custom"})
     assert r.json()["title"] == "Custom"
+
+
+def test_upload_small_file(client):
+    files = {"file": ("hi.txt", b"abc", "text/plain")}
+    data = {"is_public": "true", "ttl": "24h"}
+    r = client.post("/api/items/upload", files=files, data=data)
+    assert r.status_code == 200
+    slug = r.json()["slug"]
+    f = client.get(f"/api/items/{slug}/file")
+    assert f.status_code == 200
+    assert f.content == b"abc"
+
+
+def test_reject_oversize(client, monkeypatch):
+    import app.config as config_module
+
+    monkeypatch.setattr(config_module.settings, "max_upload_mb", 1)
+    big = b"x" * (1 * 1024 * 1024 + 1)
+    files = {"file": ("big.txt", big, "text/plain")}
+    r = client.post("/api/items/upload", files=files, data={"is_public": "true", "ttl": "24h"})
+    assert r.status_code == 413
+
+
+def test_reject_disallowed_extension(client):
+    files = {"file": ("malware.exe", b"mz", "application/octet-stream")}
+    r = client.post(
+        "/api/items/upload",
+        files=files,
+        data={"is_public": "true", "ttl": "24h"},
+    )
+    assert r.status_code == 400