fix: harden real backend admin workflows and ui

api/src/files/files.controller.ts

@@ -1,8 +1,16 @@
-import { Body, Controller, Get, Post } from '@nestjs/common';
+import { Body, Controller, Get, Post, UploadedFile, UseInterceptors } from '@nestjs/common';
+import { FileInterceptor } from '@nestjs/platform-express';
 import { ApiTags } from '@nestjs/swagger';
 import { TenantId } from '../common/tenant-id.decorator';
 import { CreateFileObjectDto, CreatePresignedUploadDto, FilesService } from './files.service';
 
+type UploadedMultipartFile = {
+  originalname: string;
+  mimetype: string;
+  size: number;
+  buffer: Buffer;
+};
+
 @ApiTags('files')
 @Controller('admin/files')
 export class FilesController {
@@ -22,4 +30,10 @@ export class FilesController {
   createPresignedUpload(@Body() body: CreatePresignedUploadDto) {
     return this.files.createPresignedUpload(body);
   }
+
+  @Post('upload')
+  @UseInterceptors(FileInterceptor('file', { limits: { fileSize: 20 * 1024 * 1024 } }))
+  upload(@UploadedFile() file: UploadedMultipartFile, @Body('purpose') purpose: string, @Body('prefix') prefix?: string, @TenantId() tenantId?: string) {
+    return this.files.upload({ tenantId, purpose: purpose || 'general', prefix }, file);
+  }
 }