feat(tickets): Foto-/Datei-Anhänge an Tickets

- Anhänge im Melde-Fenster (beim Erstellen) und direkt an bestehenden Tickets:
  Vorschaubilder, Öffnen im neuen Tab, Entfernen.
- Bytes liegen in eigener Tabelle (FeedbackAttachment, lose FeedbackId ohne FK →
  übersteht den Ingest-Wipe); GET /feedback liefert nur Metadaten (id/Name/Typ/Größe),
  die Bytes über /feedback/attachments/{id}. Größenlimit 10 MB.
- Endpoints: POST /feedback/{id}/attachments (base64), GET /feedback/attachments/{id}
  (Bytes), DELETE /feedback/attachments/{id}.

Migration FeedbackAttachments. Tests: 262 Backend grün (+Upload/Serve/Delete +Validierung),
e2e Tickets Desktop+Phone grün (+Foto-Upload), vitest 149.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

GerbilManagerWebAPI/Endpoints/FeedbackEndpoints.cs

@@ -21,6 +21,9 @@ namespace GerbilManagerWebAPI.Endpoints
         /// <summary>Aufbewahrungsfrist im Papierkorb: danach werden Tickets endgültig gelöscht.</summary>
         private const int TrashRetentionDays = 30;
 
+        /// <summary>Maximale Anhang-Größe (10 MB) — Fotos vom Handy passen locker, schützt aber die DB.</summary>
+        private const int MaxAttachmentBytes = 10 * 1024 * 1024;
+
         public static IEndpointRouteBuilder MapFeedbackEndpoints(this IEndpointRouteBuilder app)
         {
             var group = app.MapGroup("/feedback").WithTags("Feedback");
@@ -69,9 +72,21 @@ namespace GerbilManagerWebAPI.Endpoints
                     rows = rows.Except(expired).ToList();
                 }
 
+                // Anhang-Metadaten (OHNE Bytes) laden und je Ticket zuordnen.
+                var attMeta = await db.FeedbackAttachments
+                    .Select(a => new { a.Id, a.FeedbackId, a.FileName, a.ContentType, a.Size })
+                    .ToListAsync();
+                var byTicket = attMeta
+                    .GroupBy(a => a.FeedbackId)
+                    .ToDictionary(
+                        g => g.Key,
+                        g => (IReadOnlyList<FeedbackAttachmentDto>)g
+                            .Select(a => new FeedbackAttachmentDto(a.Id, a.FileName, a.ContentType, a.Size))
+                            .ToList());
+
                 return TypedResults.Ok(rows
                     .OrderByDescending(f => f.CreatedAt)
-                    .Select(ToDto)
+                    .Select(f => ToDto(f, byTicket.GetValueOrDefault(f.Id)))
                     .ToList());
             });
 
@@ -222,6 +237,73 @@ namespace GerbilManagerWebAPI.Endpoints
                 return TypedResults.Ok(ToDto(entity));
             });
 
+            // ANHANG hochladen (base64). Bild/Datei zu einem Ticket. Größenlimit MaxAttachmentBytes.
+            group.MapPost("/{id:guid}/attachments", async Task<Results<Created<FeedbackAttachmentDto>, NotFound, BadRequest<string>>> (
+                Guid id, FeedbackAttachmentInput input, ApplicationContext db) =>
+            {
+                var ticket = await db.Feedback.FirstOrDefaultAsync(f => f.Id == id);
+                if (ticket is null)
+                    return TypedResults.NotFound();
+                if (string.IsNullOrWhiteSpace(input.DataBase64) || string.IsNullOrWhiteSpace(input.FileName))
+                    return TypedResults.BadRequest("FileName und Daten sind erforderlich.");
+
+                byte[] bytes;
+                try
+                {
+                    // erlaubt sowohl reines base64 als auch eine data:-URL
+                    var raw = input.DataBase64;
+                    var comma = raw.IndexOf(',');
+                    if (raw.StartsWith("data:", StringComparison.OrdinalIgnoreCase) && comma >= 0)
+                        raw = raw[(comma + 1)..];
+                    bytes = Convert.FromBase64String(raw);
+                }
+                catch (FormatException)
+                {
+                    return TypedResults.BadRequest("Daten sind kein gültiges base64.");
+                }
+                if (bytes.Length == 0)
+                    return TypedResults.BadRequest("Datei ist leer.");
+                if (bytes.Length > MaxAttachmentBytes)
+                    return TypedResults.BadRequest($"Datei zu groß (max. {MaxAttachmentBytes / (1024 * 1024)} MB).");
+
+                var att = new FeedbackAttachment
+                {
+                    Id = Guid.NewGuid(),
+                    FeedbackId = id,
+                    FileName = input.FileName.Trim(),
+                    ContentType = string.IsNullOrWhiteSpace(input.ContentType) ? "application/octet-stream" : input.ContentType.Trim(),
+                    Size = bytes.Length,
+                    Data = bytes,
+                    CreatedAt = DateTimeOffset.UtcNow,
+                };
+                db.FeedbackAttachments.Add(att);
+                await db.SaveChangesAsync();
+                return TypedResults.Created($"/feedback/attachments/{att.Id}",
+                    new FeedbackAttachmentDto(att.Id, att.FileName, att.ContentType, att.Size));
+            });
+
+            // ANHANG-Bytes ausliefern (für <img>/Download).
+            group.MapGet("/attachments/{attId:guid}", async Task<Results<FileContentHttpResult, NotFound>> (
+                Guid attId, ApplicationContext db) =>
+            {
+                var att = await db.FeedbackAttachments.AsNoTracking().FirstOrDefaultAsync(a => a.Id == attId);
+                if (att is null)
+                    return TypedResults.NotFound();
+                return TypedResults.File(att.Data, att.ContentType, att.FileName);
+            });
+
+            // ANHANG löschen.
+            group.MapDelete("/attachments/{attId:guid}", async Task<Results<NoContent, NotFound>> (
+                Guid attId, ApplicationContext db) =>
+            {
+                var att = await db.FeedbackAttachments.FirstOrDefaultAsync(a => a.Id == attId);
+                if (att is null)
+                    return TypedResults.NotFound();
+                db.FeedbackAttachments.Remove(att);
+                await db.SaveChangesAsync();
+                return TypedResults.NoContent();
+            });
+
             return app;
         }
 
@@ -271,10 +353,11 @@ namespace GerbilManagerWebAPI.Endpoints
             }
         }
 
-        private static FeedbackDto ToDto(Feedback f) =>
+        private static FeedbackDto ToDto(Feedback f, IReadOnlyList<FeedbackAttachmentDto>? attachments = null) =>
             new(f.Id, f.Message, f.Context, f.GerbilId, f.LitterId, f.ContactId, f.EntityName, f.Url,
                 f.ClientTimestamp, f.UserAgent, f.CreatedAt, f.Status, f.ResolvedAt,
                 f.Question, f.Answer, f.AnsweredAt, f.FixNote, f.AgentContext,
-                DeserializeThread(f.Thread), f.ReopenedAt, f.DeletedAt, f.Category, f.Helpful);
+                DeserializeThread(f.Thread), f.ReopenedAt, f.DeletedAt, f.Category, f.Helpful,
+                attachments ?? Array.Empty<FeedbackAttachmentDto>());
     }
 }