Object Storage Adoption for Placement & Reporting

-- Migration: YYYYMMDDHHMMSS_add_home_documents.sql
CREATE TABLE home_documents (
    id          UUID PRIMARY KEY DEFAULT uuidv7(),
    home_id     UUID NOT NULL REFERENCES foster_homes(id),
    filename    VARCHAR(255) NOT NULL,
    content_type VARCHAR(127) NOT NULL,
    size_bytes  BIGINT NOT NULL,
    object_key  VARCHAR(512) NOT NULL,
    document_type VARCHAR(50) NOT NULL,  -- 'inspection_photo', 'license', 'training_certificate', 'other'
    uploaded_by UUID NOT NULL,
    description TEXT,
    active      BOOLEAN NOT NULL DEFAULT TRUE,
    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE INDEX idx_home_documents_home_id ON home_documents(home_id) WHERE active = TRUE;

-- Migration: YYYYMMDDHHMMSS_add_afcars_export_key.sql
ALTER TABLE afcars_submissions
    ADD COLUMN export_object_key VARCHAR(512),
    ADD COLUMN export_generated_at TIMESTAMPTZ;

// Pattern: multipart extraction → validation → store → DB record
pub async fn upload_document(
    State(app): State<AppState>,
    Extension(claims): Extension<Claims>,
    Extension(object_store): Extension<Store>,
    Path(home_id): Path<Uuid>,
    mut multipart: axum::extract::Multipart,
) -> Result<Json<HomeDocument>, ApiError> {
    claims.require_caseworker_or_above()?;

    // Verify home exists
    // Extract multipart fields (file, document_type, description)
    // Validate upload (size, MIME type) using craig_store::validate_upload()
    // Sanitize filename using craig_store::sanitize_filename()
    // Build object_key: "placement-documents/{home_id}/{doc_id}/{filename}"
    // Put to object store
    // Insert DB record
    // Return HomeDocument
}

pub async fn download_document(
    State(app): State<AppState>,
    Extension(claims): Extension<Claims>,
    Extension(object_store): Extension<Store>,
    Path((home_id, doc_id)): Path<(Uuid, Uuid)>,
) -> Result<impl IntoResponse, ApiError> {
    claims.require_caseworker_or_above()?;

    // Look up document record from DB
    // Verify it belongs to home_id
    // Get bytes from object store
    // Return with Content-Type and Content-Disposition headers
    let headers = [
        (header::CONTENT_TYPE, doc.content_type.clone()),
        (header::CONTENT_DISPOSITION, format!("attachment; filename=\"{}\"", doc.filename)),
    ];
    Ok((headers, Body::from(bytes)))
}

#[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow, utoipa::ToSchema)]
pub struct HomeDocument {
    pub id: Uuid,
    pub home_id: Uuid,
    pub filename: String,
    pub content_type: String,
    pub size_bytes: i64,
    pub object_key: String,
    pub document_type: String,
    pub uploaded_by: Uuid,
    pub description: Option<String>,
    pub active: bool,
    pub created_at: DateTime<Utc>,
    pub updated_at: DateTime<Utc>,
}

.route("/homes/:home_id/documents", post(home_documents::upload_document).get(home_documents::list_documents))
.route("/homes/:home_id/documents/:doc_id/download", get(home_documents::download_document))
.route("/homes/:home_id/documents/:doc_id", delete(home_documents::delete_document))

# craig-placement
CRAIG_PLACEMENT__STORE__BACKEND: s3
CRAIG_PLACEMENT__STORE__BUCKET: craig-placement
CRAIG_PLACEMENT__STORE__S3_ENDPOINT: http://garage:3900
CRAIG_PLACEMENT__STORE__S3_REGION: garage
CRAIG_PLACEMENT__STORE__S3_ACCESS_KEY: ${GARAGE_ACCESS_KEY}
CRAIG_PLACEMENT__STORE__S3_SECRET_KEY: ${GARAGE_SECRET_KEY}
CRAIG_PLACEMENT__STORE__MAX_UPLOAD_BYTES: 10485760

# craig-reporting (same pattern, different bucket)
CRAIG_REPORTING__STORE__BUCKET: craig-reporting