feat(cli): 支持安全的单文件上传 / support safe single-file upload

[Jinghao-coding]

中文

变更内容

• 新增 crater file upload <local-file> <remote-path>，支持文本和二进制文件流式上传，不把完整文件读入内存。
• 本地仅接受普通文件；FIFO、目录、设备、非法远端根和路径穿越会在请求前拒绝。
• 默认禁止覆盖，只有显式传入 --overwrite 才允许替换已有普通文件。
• 新增 POST /api/ss/upload/*path 安全端点：完整写入、chmod、sync 和关闭后再原子发布；上传失败不会暴露半文件或截断旧文件。
• 使用 os.Root 与目录 FD 相对的 linkat/renameat 限制存储边界，并覆盖符号链接逃逸、父目录重命名和暂存目录替换竞态。
• 补齐 --json 元数据、中英文 i18n、帮助/本地与远端路径补全、文档、CLI Skill、单元测试和快照。

验证

• CLI：unit、file snapshots、race、vet、build。
• Backend：storage unit、race、vet、全量与 changed-code golangci-lint（均为 0 issues）、storage build。
• Compile-only：Linux、Windows、Solaris；不支持安全 FD 原子发布的平台会明确失败，不会回退到不安全实现。
• 本地端到端：通过 Vite 代理连接真实 storage service，验证创建 201、未授权覆盖 409/40901、显式覆盖 200，以及最终内容和 0644 权限。

说明：CLI 不会回退到旧 WebDAV PUT；旧 storage service 会安全返回 404。后续修复提交还清理了全量 lint 报告的重复路径段常量，make lint 现已完整通过。

Closes #480

---

English

Changes

• Add crater file upload <local-file> <remote-path> with streaming text and binary uploads and no whole-file buffering.
• Accept local regular files only; reject FIFOs, directories, devices, invalid roots, and traversal before any request.
• Refuse replacement by default and require explicit --overwrite for an existing regular file.
• Add a safe POST /api/ss/upload/*path endpoint. The server fully writes, chmods, syncs, and closes a staged file before atomic publication, so failures neither expose partial files nor truncate the old target.
• Constrain storage access with os.Root and directory-FD-relative linkat/renameat, with regressions for symlink escape, parent rename, and staging-name replacement races.
• Add JSON metadata, Chinese/English i18n, help and local/remote path completion, docs, a CLI Skill, unit tests, and snapshots.

Verification

• CLI: unit tests, file snapshots, race tests, vet, and build.
• Backend: storage unit/race tests, vet, full and changed-code golangci-lint (both 0 issues), and storage build.
• Compile-only checks: Linux, Windows, and Solaris; platforms without safe FD-relative publication fail explicitly instead of using an unsafe fallback.
• Local end-to-end test through the Vite proxy and real storage service: create 201, unauthorized replacement 409/40901, explicit overwrite 200, final bytes, and 0644 mode.

Note: the CLI never falls back to legacy WebDAV PUT; an older storage service fails closed with 404. The follow-up fix also removes the repeated path-segment literal reported by full lint, and make lint now passes completely.

Closes #480

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.