feat(chat_files): rewrite Upload as HTTP-forward (RFC #2312, PR-C)

[HongmingWang-Rabbit]

Summary

This is the PR where SaaS chat upload starts working again. Stacked on PR-A (#2313) + PR-B (#2314). Replaces the docker-exec path in `chat_files.go::Upload` with a streaming HTTP forward to the workspace's own `/internal/chat/uploads/ingest` endpoint (added in PR-B), authenticated with the per-workspace `platform_inbound_secret` (minted in PR-A).

Before / after

Before (#2308 root cause):
```
Upload → findContainer(ctx, wsID)
└─ h.docker is nil in SaaS (CP provisioner is selected when
MOLECULE_ORG_ID is set; dockerCli is sourced from the local
Docker provisioner)
→ returns ""
→ 503 "workspace container not running"
```

After:
```
Upload → resolve workspaces.url + platform_inbound_secret
→ stream multipart to /internal/chat/uploads/ingest
→ forward response back unchanged
```

Same call site whether the workspace runs on local docker-compose (`http://ws-:8000`) or SaaS EC2 (`https://....`). The `dockerCli == nil` cliff cannot exist by construction.

Why streaming, not parse-then-re-encode

• No 50 MB intermediate buffer on the platform
• Per-file size + path-safety enforcement is the workspace's job (see `workspace/internal_chat_uploads.py` from PR-B)
• Workspace's error responses (413 with offending filename, 400 on missing `files` field, etc.) propagate through unchanged

Changes

• `chat_files.go` — `Upload` rewritten as a streaming HTTP proxy. Drops `sanitizeFilename`, `copyFlatToContainer`, and the entire docker-exec path. `ChatFilesHandler` gains an `httpClient` (broken out for test injection). `Download` stays docker-exec for now; follow-up PR migrates it to the same shape.
• `chat_files_external_test.go` — deleted. Pinned the wrong-headed `runtime=external` 422 gate from fix(chat_files): return 422 (not misleading 503) for external workspace upload (#2308) #2309 (already reverted in revert(chat_files): drop the wrong external-runtime gate (#2308) #2311). Superseded by the proxy tests.
• `chat_files_test.go` — rewritten with sqlmock + httptest:
  • 400 invalid workspace id
  • 404 workspace row missing
  • 503 platform_inbound_secret NULL (with RFC RFC: replace Docker-exec handlers with HTTP-forward to workspace's own URL (chat upload + 5 follow-ons) #2312 detail in body)
  • 503 workspaces.url empty
  • happy-path forward (asserts auth header, content-type forwarded, body streamed, response propagated)
  • 413 from workspace propagated unchanged (not remapped to 500)
  • 502 on workspace unreachable (connect refused)
  • Existing `Download` + `ContentDisposition` tests preserved.
• `tests/e2e/test_chat_upload_e2e.sh` — single-script-everywhere E2E. Takes `BASE` as env (default `http://localhost:8080\`). Creates a workspace, waits for online, mints a test token, uploads a fixture, reads it back via `/chat/download`, asserts content matches + bearer-required. Same script runs against staging tenants by setting `BASE=https://..staging.moleculesai.app`.

Test plan

• `go build ./...` green
• `go test ./internal/handlers/ ./internal/wsauth/` green (full suite)
• `bash -n tests/e2e/test_chat_upload_e2e.sh` green
• Run E2E against local docker-compose after feat(wsauth): platform→workspace inbound secret (RFC #2312, PR-A) #2313 + feat(workspace): /internal/chat/uploads/ingest endpoint (RFC #2312, PR-B) #2314 + this merge — needed to confirm the full chain works on local Docker (proves the architecture). Will report back.
• Run E2E against fresh staging tenant after deploy — proves the SaaS path. Same script, just different `BASE`.
• Migrate `Download` to the same HTTP-forward shape — separate PR (PR-D).
• Migrate `/files/*`, `/templates/import`, plugin install, terminal — separate PRs.

Refs

• `RFC: replace Docker-exec handlers with HTTP-forward to workspace's own URL (chat upload + 5 follow-ons) #2312` — parent RFC
• `[Bug] File upload to external/remote workspace returns 503 'container not running' (split from #2305) #2308` — chat upload 503 incident
• PR `feat(wsauth): platform→workspace inbound secret (RFC #2312, PR-A) #2313` — PR-A foundation (schema + token mint)
• PR `feat(workspace): /internal/chat/uploads/ingest endpoint (RFC #2312, PR-B) #2314` — PR-B workspace-side endpoint

🤖 Generated with Claude Code

[HongmingWang-Rabbit]

Holding approval pending coverage gaps.

Re-audited test coverage; my prior approval was actually better than I gave it credit for — TestChatUpload_ForwardsErrorStatusUnchanged and TestChatUpload_WorkspaceUnreachable are present and pin the two failure modes I'd flagged in my comment. Mea culpa for undercounting.

One remaining gap on Upload:

1. Generic ReadPlatformInboundSecret error (non-ErrNoInboundSecret) → 500 'failed to read workspace secret'. Currently only the NULL-secret → 503 path is tested. A db-error stub (e.g. connection drop after the URL lookup succeeded) would pin this last error class.

Optional / hard-to-provoke: the io.Copy mid-stream error path just logs (status already committed) — usually not worth a test, calling out for completeness.

This PR is the closest-to-100% of the three. Re-approve once #1 is pinned (or the user explicitly waives it as a 500-fallthrough not worth a test).

[HongmingWang-Rabbit]

Validation update — full chain works end-to-end

Ran the actual E2E against local docker-compose with all of A+B+C applied to the platform binary AND companion runtime PR (Molecule-AI/molecule-ai-workspace-runtime#60) installed in the workspace container:

```
canvas/molecli ──curl──▶ platform Go workspace-server (8080)
↓ resolves workspaces.url + platform_inbound_secret
↓ streams multipart
workspace's own server (62233) /internal/chat/uploads/ingest
↓ validates Authorization: Bearer
↓ writes to /workspace/.molecule/chat-uploads/ (0600)
200 {"files":[{"uri":"workspace:/...","name":"greeting.txt","size":27}]}
```

5/5 functional checks green:

1. Workspace create + provision ✓
2. Token mint ✓
3. Platform → workspace HTTP forward, multipart streamed ✓
4. File lands at `/workspace/.molecule/chat-uploads/-` with mode 0600 ✓ (better than my review's refactor(mcp-server): DRY envelopes, typed apiCall, explicit re-exports #4 finding — _open_safe already enforces 0600 via os.open(..., 0o600); the 0644 concern was for /configs/* files written via tar)
5. Download round-trip — content matches verbatim ✓

Two pre-existing findings surfaced during the run (filing separately):

• workspaces.url doesn't refresh after docker restart reassigns the host port. Heartbeat updates last_heartbeat_at but not url. Bit me when I had to manually UPDATE workspaces SET url=... after restarting the container with the new wheel.
• host.docker.internal doesn't resolve when the platform Go binary runs OUTSIDE Docker (the dev convenience path). Provisioner-driven URLs may need awareness of host vs container caller for local dev — pre-existing.

The runtime PR (#60) needs to merge + a 0.1.18 wheel needs to publish before this stack works in any environment that pulls from PyPI (i.e., every environment except this overlay-installed local box). Sequence:

1. Merge molecule-core PR-A (feat(wsauth): platform→workspace inbound secret (RFC #2312, PR-A) #2313)
2. Merge molecule-core PR-B (feat(workspace): /internal/chat/uploads/ingest endpoint (RFC #2312, PR-B) #2314)
3. Merge molecule-core PR-C (feat(chat_files): rewrite Upload as HTTP-forward (RFC #2312, PR-C) #2315) ← this PR
4. Merge runtime PR feat(.claude): 5 gstack-inspired skills + cron upgrades #60 + publish 0.1.18 to PyPI
5. Bump runtime pin in template repos (langgraph, claude-code, hermes, etc.) to ≥0.1.18
6. Republish template images
7. SaaS chat upload starts working