fix(file-service): restore public upload by explicitly allowing POST /api/file/upload

The previous commit (GET-only permitAll) inadvertently broke upload by
requiring auth. The original design intentionally allows unauthenticated
upload — explicitly permit POST /api/file/upload to make this clear.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

file-service/src/main/java/com/xuqm/file/config/SecurityConfig.java

@@ -36,12 +36,12 @@ public class SecurityConfig {
             .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
             .authorizeHttpRequests(auth -> auth
                 .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
-                // Public: serve files by hash and thumbnails (GET only — upload requires auth)
-                .requestMatchers(HttpMethod.GET, "/api/file/*/thumbnail").permitAll()
-                .requestMatchers(HttpMethod.GET, "/api/file/*").permitAll()
+                // Public: file upload and serving by hash (upload is intentionally public)
+                .requestMatchers("/api/file/upload").permitAll()
+                .requestMatchers("/api/file/*/thumbnail").permitAll()
+                .requestMatchers("/api/file/*").permitAll()
                 // Actuator health & info
                 .requestMatchers("/actuator/**").permitAll()
-                // Everything else (including POST /api/file/upload) requires authentication
                 .anyRequest().authenticated()
             )
             .exceptionHandling(ex -> ex