feat: add S3 file uploads via pushduck

[abhay-ramesh]

Summary

• Adds app/api/upload/route.ts — a type-safe pushduck upload router with two routes: profileImage (4 MB, image/*) and document (16 MB, common document types)
• Auth is enforced in each route's .middleware() using the repo's existing getUser() helper from lib/db/queries; unauthenticated requests receive a 401
• Files are organised under users/<userId>/avatar/ and users/<userId>/documents/<timestamp>-<name> in the S3 bucket
• Adds components/file-upload.tsx — a reusable <FileUpload> React component built on pushduck/client that shows per-file progress and status, styled with the existing Radix UI <Button>
• Adds pushduck: "^0.4.0" to package.json
• Documents the four required env vars in .env.example

Usage

// Profile avatar
<FileUpload
  route="profileImage"
  accept="image/*"
  label="Change avatar"
  onSuccess={(url) => setAvatarUrl(url)}
/>

// Document upload
<FileUpload
  route="document"
  accept=".pdf,.doc,.docx"
  label="Upload document"
/>

New env vars

AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_REGION=us-east-1
AWS_S3_BUCKET=

Test plan

• Set the four AWS env vars locally and start the dev server
• Sign in and navigate to a page that renders <FileUpload route="profileImage" />
• Upload a JPEG/PNG — confirm progress appears and a signed S3 URL is returned
• Confirm that uploading while signed out returns a 401
• Upload a PDF with <FileUpload route="document" /> — confirm it lands in users/<id>/documents/
• Try uploading a file larger than the configured limit and confirm the error is surfaced in the UI

[vercel]

@abhay-ramesh is attempting to deploy a commit to the Vercel Team on Vercel.

A member of the Team first needs to authorize it.