Add /admin/uploads HTML page and JSON API backed by the upload_files
DB index. The page lists file_id, name, size (KB), uploaded_at, and
sha256 with client-side search by name, column sort, and per-row delete.
DELETE /admin/uploads/:id removes the DB index row and the on-disk
data file plus .meta.json sidecar. Admin deletes are written to the
audit log.
Wire the new dependencies through admin.Mount and main.go, and run
the backfill step on startup so pre-existing sidecars are indexed.
Tests cover auth, HTML rendering, JSON search, delete removing all
artifacts, and audit entry creation.
Co-Authored-By: Claude <noreply@anthropic.com>