Summary

Previously the assignment submission page captured file metadata client-side and saved only `{name, size}` to `Submission.files` — actual files were never persisted (`// TODO: Upload files to Cloudinary if provided`).

• New `/api/upload/file` endpoint: server-mediated Cloudinary upload covering non-image artifacts (PDF, ZIP, DOC/DOCX, TXT/MD, plus images). Auth-required; the admin secret never leaves the server. `resource_type: "auto"` so non-image types are handled, 15 MB body limit, an `allowed_formats` allow-list, and an overridable folder.
• Submission page now validates extension + per-file size (10 MB) before reading the file, base64-encodes payloads, POSTs to the new endpoint, and stores the returned secure URLs in `Submission.files` JSON alongside the metadata.
• `` got a proper `accept` filter so the OS dialog matches the actual allow-list, and the hint copy was rewritten to list the accepted types and size cap.

Closes #1059.

Test plan

• `npm test` — 380/380 pass
• `npx biome check` on changed files — clean
• Submit an assignment with a PDF — file appears in Cloudinary under `assignments/{courseId}/{assignmentId}`, `Submission.files` JSON contains the URL
• Submit with a `.exe` — UI rejects with a specific message before any upload kicks off
• Submit with an 11 MB file — UI rejects with a specific message
• Submit with no attachments — flow is unchanged, no upload attempt
• Cloudinary upload fails — error surfaces on the page; no orphan `Submission` row created