refactor(base,learn): people's files kept by halkyon_base

ADR 0043, D2, D4, D6 and D7, the first step towards Todo's attachments:
Learn's file store moves into the module, for every server that keeps
files, and Learn becomes its first host.

halkyon_base gets the store as Learn had it: uploads into the caller's
own space by SHA-256, downloads by a row the caller may read, each
person's room (FILE_LIMIT_IDENTIFIED_MB, FILE_LIMIT_INSTANCE_MB, the
operator's file_allowance, which moves into the module unchanged) and
the pruning of files no live row names. It stays free of the sync
engine: a host hands it a FileStore saying which of its rows name a file
and what it takes (HalkyonBase.files); without one the files endpoint
refuses. Its tests, with refusals, run on a stand-in host.

Learn hands it learnFiles: its asset rows, read by their space's members,
a readable file over 20 MB only as a PDF, up to 100 MB. Its app calls the
module; its own asset endpoint stays for released apps alone, forwarding
to the module in Learn's own models, whose names are on the wire. Its
file tests still pass through it, end to end.

Migrations: the module's creates file_allowance. Learn's server migration
holds version rows alone, as tables are matched by name (ADR 0014); its
device migration creates the module's empty table, as every module's.
Todo's, Train's and Meditate's create the empty table.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0043-shared-file-store-todo-attachments.md

@@ -2,7 +2,8 @@
 
 - **Status:** decided 10 Nov 2026 by the developer: D1 and D2 are their own requests,
   D3 their choice over the agent's recommendation (20 MB), D4 and D5 the agent's
-  recommendations, which they chose. Not built yet.
+  recommendations, which they chose. D2, D4, D6 and D7 built 10 Nov 2026 (below);
+  Todo's attachments come next.
 - **Builds on:** ADR 0004 (Learn's assets, rule 5), ADR 0014 (the module), ADR 0017
   (the account's keys), ADR 0019 (sealed files), ADR 0033 (Todo), ADR 0042 (mobile data).
 
@@ -40,6 +41,22 @@ asked for attachments in both, now (10 Nov 2026).
   holds back uploads and downloads alike; a file not fetched shows as its chip with
   *Download*.
 
+## Decided while building (10 Nov 2026, the developer's choices of the agent's recommendations)
+
+- **D6.** **The module stays free of the sync engine.** Each app's server hands it hooks,
+  as `deletePersonData`: which file a row the caller may read names (for downloads, by
+  the row's ID, as Learn's `download(assetId)`), which hashes a space's live rows name
+  (for the room counted and the pruning), and what it accepts (Learn: a readable file
+  over 20 MB only as a PDF; Todo: sealed files alone). A server without them offers no
+  files (Train, Meditate).
+- **D7.** **Older Learn apps keep working:** Learn's `asset` endpoint stays as a thin
+  forwarder to the module's, with its own `FileUsage` and `FileLimitExceededException`
+  (their names on the wire are Learn's), until a later release raises
+  `minimumAppBuild` and drops it.
+- **D8.** **Todo shows attachments in a row below the text** of a description or a
+  comment, as Todoist does: images as thumbnails opening full-size, other files as chips;
+  added with a paperclip button. halkyon_editor doesn't change.
+
 ## Todo's rows
 
 An `attachment` table, synced and sealed as every Todo table: the file's hash, sealed
@@ -56,3 +73,22 @@ module's pruning removes a file no row names any more.
 - Whether the sealed header (`HLKF`) and Learn's `SealedFile` move to `halkyon_keys`
   for Todo to share, which the recommendation is.
 - The quota's text in Todo's Settings: Learn shows the room used in its Sync card.
+
+## As built: the store in halkyon_base (10 Nov 2026)
+
+- `packages/halkyon_base_server/lib/src/files/`: `FileStore` (the host's hooks
+  `fileOfRow`, `liveHashes`, `accepts`; `maxBytes`, 100 MB unless said), the store's
+  logic as functions (`startFileUpload`, `finishFileUpload`, `fileUsageOf`,
+  `downloadFile`) under the `files` endpoint, the room (`file_limits.dart`) and the
+  pruning (`pruneUnreferencedFiles`, scheduled by each host in a future call of its own),
+  moved from Learn with their tests; `FileAllowance` moved as it was (its table keeps its
+  name), deleted with the person by the module now. Models of the module's own:
+  `FileUsage`, `FileLimitExceededException`, `StoredFileNotFoundException`.
+- Migrations: the module's `file-store` creates `file_allowance`; Learn's holds version
+  rows alone (Serverpod matches tables by name, as ADR 0014 found), its device migration
+  creating the module's empty table, as every module's; Todo's, Train's and Meditate's
+  create the empty table, which only Todo will use.
+- Learn: `learnFiles` (its `asset` rows, their spaces' members, a readable file over
+  20 MB only as a PDF); `AssetEndpoint` a forwarder in Learn's models for released apps;
+  the app calls the module (`client.modules.base.files`).
+