fix(files): authorize metadata with internal user ids

[rissrice2105-agent]

Summary

• resolve the internal profile ID before authorizing HEAD and POST /api/files/:fileId
• traverse the valid messages -> conversations -> conversation_participants relationship used by the working download handler
• preserve ownership detection for records written with either auth UUIDs or legacy internal IDs

Tests

• all file-route tests: 21 passed across 5 files
• ESLint on both changed files
• git diff --check

Local tooling note

The repository's default Vitest config currently fails before collection because locked @vitejs/plugin-react@6 imports an unexported Vite 7 subpath. The non-JSX file-route tests were run with the same environment, setup file, and aliases without that plugin. The configured Prettier plugin is also not declared locally; no dependency files were changed.

Closes #216