Problem

src/pages/assignments/submit/[assignmentId].tsx has a TODO: Upload files to Cloudinary if provided. File uploads are referenced in the UI but not actually persisted.

Expected behavior

Users can attach files to their assignment submission; files are uploaded to Cloudinary and the resulting URLs are saved with the submission record.

Acceptance criteria

• File input accepts the allowed types/sizes documented by the assignment.
• Files uploaded to Cloudinary via signed upload (no client-side exposure of admin credentials).
• Uploaded URLs stored with the Submission record in the DB.
• Upload failures surfaced to the user (not silent).
• Existing submissions unaffected; migration tested.

Suggested approach

Reuse the existing Cloudinary env setup (CLOUDINARY_API_KEY, CLOUDINARY_API_SECRET, NEXT_PUBLIC_CLOUDINARY_CLOUD_NAME per .env.example). The blog-image manager at src/components/blog-image-manager/ already integrates Cloudinary — mirror that pattern.

Consider a signed-upload endpoint (/api/uploads/sign) so the client never sees the admin secret.