fix: burn file items after download, not metadata fetch

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_items.py

@@ -99,3 +99,23 @@ def test_reject_disallowed_extension(client):
         data={"is_public": "true", "ttl": "24h"},
     )
     assert r.status_code == 400
+
+
+def test_file_burn_after_download_not_metadata(client):
+    files = {"file": ("secret.txt", b"top-secret", "text/plain")}
+    data = {"is_public": "true", "ttl": "24h", "burn_after_read": "true"}
+    r = client.post("/api/items/upload", files=files, data=data)
+    assert r.status_code == 200
+    slug = r.json()["slug"]
+
+    meta = client.get(f"/api/items/{slug}")
+    assert meta.status_code == 200
+    assert meta.json()["file_name"] == "secret.txt"
+    assert meta.json()["burn_after_read"] is True
+
+    first = client.get(f"/api/items/{slug}/file")
+    assert first.status_code == 200
+    assert first.content == b"top-secret"
+
+    assert client.get(f"/api/items/{slug}/file").status_code == 404
+    assert client.get(f"/api/items/{slug}").status_code == 404