feat(files): upload/preview/delete allegati su fatture, ULA, documenti

- models: colonne file inline (storage_path, mime, size_bytes, sha256, uploaded_by, uploaded_at)
  su remission_invoice, remission_ula_employee, remission_document
- migrations: ALTER idempotente al lifespan per evolvere schema in sandbox
- storage: FS adapter /var/uploads con validazione MIME/size, dedup sha256, sanitize
- routers/files: POST upload / GET download (con ?inline=1) / DELETE
  matrix autorizzazioni: beneficiary su DRAFT|AWAITING_AMENDMENT, istruttore read-only, superadmin full
- main: include router files, version bump 0.2.0

Testato E2E con admin JWT: upload 549B PDF -> DB coerente, storage 1/invoice/<uuid>/<sha12>-file.pdf,
download con magic bytes PDF corretti, delete chirurgico con cleanup FS e metadata.

app/main.py

@@ -1,9 +1,9 @@
 """
 rendicontazione-api — microservizio sviluppato da BFLOWS per Gepafin.
 Gestisce schemi di rendicontazione per bando, pratiche di rendicontazione,
-fatture, ULA, soccorso istruttorio.
+fatture, ULA, soccorso istruttorio, upload file, verbale istruttoria.
 
-Stack: FastAPI + SQLAlchemy + PostgreSQL (schema gepafin_rendic).
+Stack: FastAPI + SQLAlchemy + PostgreSQL (schema gepafin_rendic) + weasyprint.
 Auth: JWT condiviso con GEPAFIN-BE.
 """
 import logging
@@ -14,7 +14,8 @@ from sqlalchemy import text
 
 from .config import get_settings
 from .db import engine, Base
-from .routers import health, schemas, practices, debug, instructor
+from .migrations import run_migrations
+from .routers import health, schemas, practices, debug, instructor, files, verbale
 
 logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(name)s: %(message)s")
 log = logging.getLogger("rendicontazione-api")
@@ -25,12 +26,12 @@ settings = get_settings()
 @asynccontextmanager
 async def lifespan(app: FastAPI):
     log.info("Avvio rendicontazione-api")
-    # Crea schema e tabelle se non esistono (bootstrap sandbox)
     try:
         with engine.begin() as conn:
             conn.execute(text(f'CREATE SCHEMA IF NOT EXISTS {settings.db_schema}'))
         Base.metadata.create_all(bind=engine)
-        log.info(f"Schema '{settings.db_schema}' e tabelle inizializzate")
+        run_migrations(engine)
+        log.info(f"Schema '{settings.db_schema}' + tabelle + migrations OK")
     except Exception as e:
         log.error(f"Errore bootstrap DB: {e}")
         raise
@@ -41,7 +42,7 @@ async def lifespan(app: FastAPI):
 app = FastAPI(
     title="rendicontazione-api",
     description="Microservizio rendicontazione per Gepafin — sviluppato da BFLOWS",
-    version="0.1.0",
+    version="0.3.0",
     lifespan=lifespan,
 )
 
@@ -58,13 +59,15 @@ app.include_router(schemas.router)
 app.include_router(practices.router)
 app.include_router(debug.router)
 app.include_router(instructor.router)
+app.include_router(files.router)
+app.include_router(verbale.router)
 
 
 @app.get("/", tags=["root"])
 def root():
     return {
         "service": "rendicontazione-api",
-        "version": "0.1.0",
+        "version": "0.3.0",
         "docs": "/docs",
         "health": "/health",
     }