feat(tickets): Foto-/Datei-Anhänge an Tickets

- Anhänge im Melde-Fenster (beim Erstellen) und direkt an bestehenden Tickets:
  Vorschaubilder, Öffnen im neuen Tab, Entfernen.
- Bytes liegen in eigener Tabelle (FeedbackAttachment, lose FeedbackId ohne FK →
  übersteht den Ingest-Wipe); GET /feedback liefert nur Metadaten (id/Name/Typ/Größe),
  die Bytes über /feedback/attachments/{id}. Größenlimit 10 MB.
- Endpoints: POST /feedback/{id}/attachments (base64), GET /feedback/attachments/{id}
  (Bytes), DELETE /feedback/attachments/{id}.

Migration FeedbackAttachments. Tests: 262 Backend grün (+Upload/Serve/Delete +Validierung),
e2e Tickets Desktop+Phone grün (+Foto-Upload), vitest 149.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

GerbilManagerWebAPI/ApplicationContext.cs

@@ -25,6 +25,7 @@ public class ApplicationContext : DbContext
     public DbSet<Request> Requests => Set<Request>();
     public DbSet<MailSettings> MailSettings => Set<MailSettings>();
     public DbSet<Feedback> Feedback => Set<Feedback>();
+    public DbSet<FeedbackAttachment> FeedbackAttachments => Set<FeedbackAttachment>();
     public DbSet<AcquisitionRecord> AcquisitionRecords => Set<AcquisitionRecord>();
     public DbSet<SaleReservation> SaleReservations => Set<SaleReservation>();
     public DbSet<WaitingListEntry> WaitingListEntries => Set<WaitingListEntry>();

GerbilManagerWebAPI/Dtos/FeedbackDtos.cs

@@ -20,6 +20,19 @@ namespace GerbilManagerWebAPI.Dtos
         string Text,
         DateTimeOffset? At);
 
+    /// <summary>FEEDBACK: lightweight metadata for an attachment (no bytes).</summary>
+    public record FeedbackAttachmentDto(
+        Guid Id,
+        string FileName,
+        string ContentType,
+        int Size);
+
+    /// <summary>FEEDBACK: payload to upload an attachment (base64-encoded bytes).</summary>
+    public record FeedbackAttachmentInput(
+        string FileName,
+        string ContentType,
+        string DataBase64);
+
     /// <summary>FEEDBACK: response DTO for a stored report.</summary>
     public record FeedbackDto(
         Guid Id,
@@ -51,7 +64,9 @@ namespace GerbilManagerWebAPI.Dtos
         /// <summary>Optional AI-set category/topic for filtering (e.g. "Genetik", "Import"); null = none.</summary>
         string? Category = null,
         /// <summary>Was the resolution helpful? true=👍, false=👎, null=no feedback yet.</summary>
-        bool? Helpful = null);
+        bool? Helpful = null,
+        /// <summary>Attachment metadata (no bytes); fetch bytes via /feedback/attachments/{id}.</summary>
+        IReadOnlyList<FeedbackAttachmentDto>? Attachments = null);
 
     /// <summary>
     /// FEEDBACK: payload for PUT /feedback/{id}. Edit the message and/or toggle status,

GerbilManagerWebAPI/Endpoints/FeedbackEndpoints.cs

@@ -21,6 +21,9 @@ namespace GerbilManagerWebAPI.Endpoints
         /// <summary>Aufbewahrungsfrist im Papierkorb: danach werden Tickets endgültig gelöscht.</summary>
         private const int TrashRetentionDays = 30;
 
+        /// <summary>Maximale Anhang-Größe (10 MB) — Fotos vom Handy passen locker, schützt aber die DB.</summary>
+        private const int MaxAttachmentBytes = 10 * 1024 * 1024;
+
         public static IEndpointRouteBuilder MapFeedbackEndpoints(this IEndpointRouteBuilder app)
         {
             var group = app.MapGroup("/feedback").WithTags("Feedback");
@@ -69,9 +72,21 @@ namespace GerbilManagerWebAPI.Endpoints
                     rows = rows.Except(expired).ToList();
                 }
 
+                // Anhang-Metadaten (OHNE Bytes) laden und je Ticket zuordnen.
+                var attMeta = await db.FeedbackAttachments
+                    .Select(a => new { a.Id, a.FeedbackId, a.FileName, a.ContentType, a.Size })
+                    .ToListAsync();
+                var byTicket = attMeta
+                    .GroupBy(a => a.FeedbackId)
+                    .ToDictionary(
+                        g => g.Key,
+                        g => (IReadOnlyList<FeedbackAttachmentDto>)g
+                            .Select(a => new FeedbackAttachmentDto(a.Id, a.FileName, a.ContentType, a.Size))
+                            .ToList());
+
                 return TypedResults.Ok(rows
                     .OrderByDescending(f => f.CreatedAt)
-                    .Select(ToDto)
+                    .Select(f => ToDto(f, byTicket.GetValueOrDefault(f.Id)))
                     .ToList());
             });
 
@@ -222,6 +237,73 @@ namespace GerbilManagerWebAPI.Endpoints
                 return TypedResults.Ok(ToDto(entity));
             });
 
+            // ANHANG hochladen (base64). Bild/Datei zu einem Ticket. Größenlimit MaxAttachmentBytes.
+            group.MapPost("/{id:guid}/attachments", async Task<Results<Created<FeedbackAttachmentDto>, NotFound, BadRequest<string>>> (
+                Guid id, FeedbackAttachmentInput input, ApplicationContext db) =>
+            {
+                var ticket = await db.Feedback.FirstOrDefaultAsync(f => f.Id == id);
+                if (ticket is null)
+                    return TypedResults.NotFound();
+                if (string.IsNullOrWhiteSpace(input.DataBase64) || string.IsNullOrWhiteSpace(input.FileName))
+                    return TypedResults.BadRequest("FileName und Daten sind erforderlich.");
+
+                byte[] bytes;
+                try
+                {
+                    // erlaubt sowohl reines base64 als auch eine data:-URL
+                    var raw = input.DataBase64;
+                    var comma = raw.IndexOf(',');
+                    if (raw.StartsWith("data:", StringComparison.OrdinalIgnoreCase) && comma >= 0)
+                        raw = raw[(comma + 1)..];
+                    bytes = Convert.FromBase64String(raw);
+                }
+                catch (FormatException)
+                {
+                    return TypedResults.BadRequest("Daten sind kein gültiges base64.");
+                }
+                if (bytes.Length == 0)
+                    return TypedResults.BadRequest("Datei ist leer.");
+                if (bytes.Length > MaxAttachmentBytes)
+                    return TypedResults.BadRequest($"Datei zu groß (max. {MaxAttachmentBytes / (1024 * 1024)} MB).");
+
+                var att = new FeedbackAttachment
+                {
+                    Id = Guid.NewGuid(),
+                    FeedbackId = id,
+                    FileName = input.FileName.Trim(),
+                    ContentType = string.IsNullOrWhiteSpace(input.ContentType) ? "application/octet-stream" : input.ContentType.Trim(),
+                    Size = bytes.Length,
+                    Data = bytes,
+                    CreatedAt = DateTimeOffset.UtcNow,
+                };
+                db.FeedbackAttachments.Add(att);
+                await db.SaveChangesAsync();
+                return TypedResults.Created($"/feedback/attachments/{att.Id}",
+                    new FeedbackAttachmentDto(att.Id, att.FileName, att.ContentType, att.Size));
+            });
+
+            // ANHANG-Bytes ausliefern (für <img>/Download).
+            group.MapGet("/attachments/{attId:guid}", async Task<Results<FileContentHttpResult, NotFound>> (
+                Guid attId, ApplicationContext db) =>
+            {
+                var att = await db.FeedbackAttachments.AsNoTracking().FirstOrDefaultAsync(a => a.Id == attId);
+                if (att is null)
+                    return TypedResults.NotFound();
+                return TypedResults.File(att.Data, att.ContentType, att.FileName);
+            });
+
+            // ANHANG löschen.
+            group.MapDelete("/attachments/{attId:guid}", async Task<Results<NoContent, NotFound>> (
+                Guid attId, ApplicationContext db) =>
+            {
+                var att = await db.FeedbackAttachments.FirstOrDefaultAsync(a => a.Id == attId);
+                if (att is null)
+                    return TypedResults.NotFound();
+                db.FeedbackAttachments.Remove(att);
+                await db.SaveChangesAsync();
+                return TypedResults.NoContent();
+            });
+
             return app;
         }
 
@@ -271,10 +353,11 @@ namespace GerbilManagerWebAPI.Endpoints
             }
         }
 
-        private static FeedbackDto ToDto(Feedback f) =>
+        private static FeedbackDto ToDto(Feedback f, IReadOnlyList<FeedbackAttachmentDto>? attachments = null) =>
             new(f.Id, f.Message, f.Context, f.GerbilId, f.LitterId, f.ContactId, f.EntityName, f.Url,
                 f.ClientTimestamp, f.UserAgent, f.CreatedAt, f.Status, f.ResolvedAt,
                 f.Question, f.Answer, f.AnsweredAt, f.FixNote, f.AgentContext,
-                DeserializeThread(f.Thread), f.ReopenedAt, f.DeletedAt, f.Category, f.Helpful);
+                DeserializeThread(f.Thread), f.ReopenedAt, f.DeletedAt, f.Category, f.Helpful,
+                attachments ?? Array.Empty<FeedbackAttachmentDto>());
     }
 }

GerbilManagerWebAPI/Migrations/20260623092227_FeedbackAttachments.cs

@@ -0,0 +1,39 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace GerbilManagerWebAPI.Migrations
+{
+    /// <inheritdoc />
+    public partial class FeedbackAttachments : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "FeedbackAttachments",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uuid", nullable: false),
+                    FeedbackId = table.Column<Guid>(type: "uuid", nullable: false),
+                    FileName = table.Column<string>(type: "text", nullable: false),
+                    ContentType = table.Column<string>(type: "text", nullable: false),
+                    Size = table.Column<int>(type: "integer", nullable: false),
+                    Data = table.Column<byte[]>(type: "bytea", nullable: false),
+                    CreatedAt = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_FeedbackAttachments", x => x.Id);
+                });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "FeedbackAttachments");
+        }
+    }
+}

GerbilManagerWebAPI/Migrations/ApplicationContextModelSnapshot.cs

@@ -960,6 +960,38 @@ namespace GerbilManagerWebAPI.Migrations
                     b.ToTable("Feedback");
                 });
 
+            modelBuilder.Entity("GerbilManagerWebAPI.Models.FeedbackAttachment", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("ContentType")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<byte[]>("Data")
+                        .IsRequired()
+                        .HasColumnType("bytea");
+
+                    b.Property<Guid>("FeedbackId")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("FileName")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Size")
+                        .HasColumnType("integer");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("FeedbackAttachments");
+                });
+
             modelBuilder.Entity("GerbilManagerWebAPI.Models.Gerbil", b =>
                 {
                     b.Property<Guid>("Id")

GerbilManagerWebAPI/Models/FeedbackAttachment.cs

@@ -0,0 +1,31 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace GerbilManagerWebAPI.Models
+{
+    /// <summary>
+    /// An image/file attached to a feedback ticket (z. B. ein Foto vom Tier/Fellschlag/Stammbaum).
+    /// Like <see cref="Feedback"/> it is decoupled (loose FeedbackId, no FK) so it survives the
+    /// import re-ingest wipe. The bytes live in the DB (single-user app, gelegentliche Fotos) —
+    /// die Liste GET /feedback liefert nur Metadaten, die Bytes kommen über einen eigenen Endpoint.
+    /// </summary>
+    public class FeedbackAttachment
+    {
+        [Key]
+        public Guid Id { get; set; }
+
+        /// <summary>Loose reference (no FK) to the feedback ticket this belongs to.</summary>
+        public Guid FeedbackId { get; set; }
+
+        public required string FileName { get; set; }
+
+        public required string ContentType { get; set; }
+
+        /// <summary>Größe in Bytes (separat gespeichert, damit Listen-Abfragen die Bytes nicht laden).</summary>
+        public int Size { get; set; }
+
+        /// <summary>The raw file bytes.</summary>
+        public required byte[] Data { get; set; }
+
+        public DateTimeOffset CreatedAt { get; set; }
+    }
+}