refactor: migrate binary file serving from gRPC to dedicated HTTP fileserver

Migrates attachment and avatar binary serving from gRPC endpoints to a new dedicated HTTP fileserver package, fixing Safari video playback issues and improving architectural separation.

Key changes:
- Created server/router/fileserver package for all binary file serving
- Removed GetAttachmentBinary and GetUserAvatar gRPC endpoints from proto
- Implemented native HTTP handlers with full range request support
- Added authentication support (session cookies + JWT) to fileserver
- New avatar endpoint supports lookup by user ID or username
- Eliminated duplicate auth constants (imports from api/v1)

HTTP endpoints:
- Attachments: /file/attachments/:uid/:filename (unchanged URL)
- Avatars: /file/users/:identifier/avatar (new URL format)

This fixes Safari video/audio playback by using http.ServeContent() which properly handles HTTP 206 Partial Content responses and range request headers.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: boojack

proto/api/v1/attachment_service.proto

@@ -5,7 +5,6 @@ package memos.api.v1;
 import "google/api/annotations.proto";
 import "google/api/client.proto";
 import "google/api/field_behavior.proto";
-import "google/api/httpbody.proto";
 import "google/api/resource.proto";
 import "google/protobuf/empty.proto";
 import "google/protobuf/field_mask.proto";
@@ -31,11 +30,6 @@ service AttachmentService {
     option (google.api.http) = {get: "/api/v1/{name=attachments/*}"};
     option (google.api.method_signature) = "name";
   }
-  // GetAttachmentBinary returns a attachment binary by name.
-  rpc GetAttachmentBinary(GetAttachmentBinaryRequest) returns (google.api.HttpBody) {
-    option (google.api.http) = {get: "/file/{name=attachments/*}/{filename}"};
-    option (google.api.method_signature) = "name,filename,thumbnail";
-  }
   // UpdateAttachment updates a attachment.
   rpc UpdateAttachment(UpdateAttachmentRequest) returns (Attachment) {
     option (google.api.http) = {
@@ -138,21 +132,6 @@ message GetAttachmentRequest {
   ];
 }
 
-message GetAttachmentBinaryRequest {
-  // Required. The attachment name of the attachment.
-  // Format: attachments/{attachment}
-  string name = 1 [
-    (google.api.field_behavior) = REQUIRED,
-    (google.api.resource_reference) = {type: "memos.api.v1/Attachment"}
-  ];
-
-  // The filename of the attachment. Mainly used for downloading.
-  string filename = 2 [(google.api.field_behavior) = REQUIRED];
-
-  // Optional. A flag indicating if the thumbnail version of the attachment should be returned.
-  bool thumbnail = 3 [(google.api.field_behavior) = OPTIONAL];
-}
-
 message UpdateAttachmentRequest {
   // Required. The attachment which replaces the attachment on the server.
   Attachment attachment = 1 [(google.api.field_behavior) = REQUIRED];

proto/api/v1/user_service.proto

@@ -6,7 +6,6 @@ import "api/v1/common.proto";
 import "google/api/annotations.proto";
 import "google/api/client.proto";
 import "google/api/field_behavior.proto";
-import "google/api/httpbody.proto";
 import "google/api/resource.proto";
 import "google/protobuf/empty.proto";
 import "google/protobuf/field_mask.proto";
@@ -53,12 +52,6 @@ service UserService {
     option (google.api.method_signature) = "name";
   }
 
-  // GetUserAvatar gets the avatar of a user.
-  rpc GetUserAvatar(GetUserAvatarRequest) returns (google.api.HttpBody) {
-    option (google.api.http) = {get: "/api/v1/{name=users/*}/avatar"};
-    option (google.api.method_signature) = "name";
-  }
-
   // ListAllUserStats returns statistics for all users.
   rpc ListAllUserStats(ListAllUserStatsRequest) returns (ListAllUserStatsResponse) {
     option (google.api.http) = {get: "/api/v1/users:stats"};
@@ -324,15 +317,6 @@ message DeleteUserRequest {
   bool force = 2 [(google.api.field_behavior) = OPTIONAL];
 }
 
-message GetUserAvatarRequest {
-  // Required. The resource name of the user.
-  // Format: users/{user}
-  string name = 1 [
-    (google.api.field_behavior) = REQUIRED,
-    (google.api.resource_reference) = {type: "memos.api.v1/User"}
-  ];
-}
-
 // User statistics messages
 message UserStats {
   option (google.api.resource) = {