feat(faz3): implement file upload with Cloudflare R2

- Add AWS SDK for S3-compatible R2 storage
- Create R2 client with presigned URL support
- Add attachment upload/download/delete API routes
- Create FileUpload and AttachmentList components
- Integrate file upload in message form (new & edit)
- Add .env.example with R2 configuration

src/app/api/attachments/[attachmentId]/route.ts

@@ -0,0 +1,65 @@
+import { NextResponse } from "next/server";
+import { getServerSession } from "next-auth";
+import { authOptions } from "@/lib/auth/options";
+import { getDownloadUrl, deleteFile } from "@/lib/r2";
+import { prisma } from "@/lib/prisma";
+
+export async function GET(
+  req: Request,
+  { params }: { params: Promise<{ attachmentId: string }> }
+) {
+  const { attachmentId } = await params;
+  const session = await getServerSession(authOptions);
+
+  if (!session?.user?.id) {
+    return new NextResponse("Unauthorized", { status: 401 });
+  }
+
+  try {
+    const attachment = await prisma.attachment.findUnique({
+      where: { id: attachmentId },
+      include: { message: true },
+    });
+
+    if (!attachment || attachment.message.userId !== session.user.id) {
+      return new NextResponse("Not found", { status: 404 });
+    }
+
+    const downloadUrl = await getDownloadUrl(attachment.fileUrl);
+    return NextResponse.json({ downloadUrl });
+  } catch (error) {
+    console.error("DOWNLOAD_URL_ERROR", error);
+    return new NextResponse("Internal Server Error", { status: 500 });
+  }
+}
+
+export async function DELETE(
+  req: Request,
+  { params }: { params: Promise<{ attachmentId: string }> }
+) {
+  const { attachmentId } = await params;
+  const session = await getServerSession(authOptions);
+
+  if (!session?.user?.id) {
+    return new NextResponse("Unauthorized", { status: 401 });
+  }
+
+  try {
+    const attachment = await prisma.attachment.findUnique({
+      where: { id: attachmentId },
+      include: { message: true },
+    });
+
+    if (!attachment || attachment.message.userId !== session.user.id) {
+      return new NextResponse("Not found", { status: 404 });
+    }
+
+    await deleteFile(attachment.fileUrl);
+    await prisma.attachment.delete({ where: { id: attachmentId } });
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    console.error("DELETE_ATTACHMENT_ERROR", error);
+    return new NextResponse("Internal Server Error", { status: 500 });
+  }
+}

src/app/api/attachments/route.ts

@@ -0,0 +1,42 @@
+import { NextResponse } from "next/server";
+import { getServerSession } from "next-auth";
+import { authOptions } from "@/lib/auth/options";
+import { getUploadUrl } from "@/lib/r2";
+import { prisma } from "@/lib/prisma";
+import { randomUUID } from "crypto";
+
+export async function POST(req: Request) {
+  const session = await getServerSession(authOptions);
+
+  if (!session?.user?.id) {
+    return new NextResponse("Unauthorized", { status: 401 });
+  }
+
+  try {
+    const { fileName, contentType, messageId } = await req.json();
+
+    const message = await prisma.message.findUnique({
+      where: { id: messageId, userId: session.user.id },
+    });
+
+    if (!message) {
+      return new NextResponse("Message not found", { status: 404 });
+    }
+
+    const key = `${session.user.id}/${messageId}/${randomUUID()}-${fileName}`;
+    const uploadUrl = await getUploadUrl(key, contentType);
+
+    const attachment = await prisma.attachment.create({
+      data: {
+        messageId,
+        fileName,
+        fileUrl: key,
+      },
+    });
+
+    return NextResponse.json({ uploadUrl, attachment });
+  } catch (error) {
+    console.error("UPLOAD_URL_ERROR", error);
+    return new NextResponse("Internal Server Error", { status: 500 });
+  }
+}