[Epic 953][Stage I][cloud-api] Retain Files views and deletion for account cleanup

[hanakannzashi]

Parent/tracking issue: #934

Implementation: #943

Goal

Restrict the Files API for the Stage I migration/export window. Existing file metadata and encrypted objects remain unchanged except when an authorized caller uses the retained normal delete operation; no new File state may be created or uploaded through cloud-api.

Scope

• Keep these existing temporary retrieval views: GET /v1/files, GET /v1/files/{file_id}, and GET /v1/files/{file_id}/content.
• Preserve their API-key authentication and workspace-scoped ownership checks.
• Retain DELETE /v1/files/{file_id} as the explicit Stage I compatibility exception for Chat's existing account-deletion worker.
• The retained DELETE route remains the existing API-key/workspace-scoped endpoint. It is not a new account-deletion-only token or internal path, so it is an intentional public mutation exception for this stage.
• Return authenticated 410 Gone for upload and every other File mutation, unsupported method, and unlisted legacy subpath.
• Apply Cache-Control: no-store to every retained Files response, including DELETE and 410 responses.
• OpenAPI advertises the three GET views and the retained DELETE operation; it excludes upload and other mutation operations and schemas.
• Do not add an export API, alter rows or S3 objects outside normal authorized deletion, or introduce an administrative data-read path.

Acceptance criteria

• The three retained GET views and retained DELETE route work only through the existing API-key/workspace boundary.
• No File creation, upload, or non-delete mutation route reaches storage or repository mutation code.
• Authenticated upload, non-delete mutations, unsupported methods, and legacy paths return the documented 410 contract; invalid/missing credentials retain their 401 boundary.
• OpenAPI and endpoint documentation describe the temporary bounded surface.
• Existing database rows, S3 objects, repositories, and migrations remain untouched by the migration itself; retained DELETE preserves its normal authorized deletion behavior.

Out of scope

• A new export or File-listing API beyond the existing GET /v1/files view.
• Historical bulk deletion, export implementation, or retention decisions.
• An account-deletion-specific Cloud credential or route.
• S3 cleanup or dropping file-related tables.
• Removing FileService/S3 startup wiring before Stage III, tracked by the Stage III cleanup work.