refactor(host): single-source ChannelPolicy, space-signed file grants, whole-file registration

- all authorization rules (owner/creator, per-channel read/write grants, who may
  remove whom, delete rules, structure management) live in ChannelPolicy; a test
  fails if they are reimplemented elsewhere
- ChannelInfo carries what the caller may do (can_*), member and invitation lists
  say who can be removed; clients display it and never derive it
- the host no longer stores or calls the file service: it only signs short-lived
  tickets from space permissions (create/put/get/delete/domain), and keeps an opaque
  fileDomain reference on the channel
- a whole file is registered in one request (last frame header + per-frame length and
  digest) instead of one request per 1 MiB frame; the signed manifest still has to
  match every digest
- drop file quota/threshold, receipts, reconcile and delete-queue code from the host
- contract generator emits constants for enums, error codes, token roles, permissions
  and share states

server/src/WebDrop.Api/Endpoints/Endpoints.cs

@@ -17,7 +17,7 @@ public static partial class Endpoints
     private const string OctetStream = "application/octet-stream";
     private static readonly TimeSpan MaxLongPoll = TimeSpan.FromSeconds(25);
 
-    public static void MapApi(this IEndpointRouteBuilder app, WebDropOptions options, ICaptchaVerifier captcha, SqliteAccountStore accounts, IFileGateway files)
+    public static void MapApi(this IEndpointRouteBuilder app, WebDropOptions options, ICaptchaVerifier captcha, SqliteAccountStore accounts, IFileGrants files)
     {
         var api = app.MapGroup("/api/v1");
 
@@ -45,7 +45,6 @@ public static partial class Endpoints
                 MaxFramesPerItem = limits.MaxFramesPerItem,
                 MaxChannelBytes = limits.MaxChannelBytes,
                 MaxWorkspaceBytes = limits.MaxWorkspaceBytes,
-                MaxWorkspaceChannelBytes = limits.MaxWorkspaceChannelBytes,
                 MaxMembers = limits.MaxMembers,
                 MaxTtlSeconds = limits.MaxTtlSeconds,
                 MinTtlSeconds = limits.MinTtlSeconds,
@@ -116,11 +115,7 @@ public static partial class Endpoints
 
             byte[] body = await ReadBody(ctx.Request, Envelope.HeaderSize + limits.MaxPayloadBytes, ct);
             var signedEvent = ParseSignedContentEvent(ctx.Request, accountStore, channelId, creds, body);
-            // 带文件服务回执的是「登记」:请求体只有头部,字节已经在文件服务里
-            var receipt = ctx.Request.Headers[FileProtocol.FileWire.ReceiptHeader].ToString();
-            var result = receipt.Length > 0
-                ? await svc.CommitRemoteFrameAsync(channelId, creds, body, receipt, maxDownloads, signedEvent)
-                : await svc.AppendFrameAsync(channelId, creds, body, maxDownloads, ct, signedEvent);
+            var result = await svc.AppendFrameAsync(channelId, creds, body, maxDownloads, ct, signedEvent);
             return Json(result, ApiJson.Default.AppendResult, result.Created ? StatusCodes.Status201Created : StatusCodes.Status200OK);
         });