[m1ngsama]

Members need to record on-site photos on repair tickets, for later review and as evidence of the device's condition.

Needs your decision

• Consul weekend/prod needs aliyun.access_key_id and aliyun.access_key_secret with write access to bucket sunday-res, ideally a RAM user limited to that bucket (util/photo.go).
• Admins can now open any event's detail, which includes the client's phone and QQ (router/event.go).
• Every request body is now capped at 25 MB (router/main.go). Please check that the reverse proxy accepts bodies that large on /member/events/*/photos; nginx defaults to 1 MB.

What changed

• POST /member/events/{EventId}/photos accepts up to 20 photos per event, 5 MB each, WebP or JPEG by content sniffing. Only the assigned member or an admin can upload, and only while the event is accepted or committed. There is no delete endpoint.
• Photos are private objects under weekend/events/{id}/, recorded in a new event_photo table (migration 000008).
• GET /member/events/{id} and GET /client/events/{id} return photos with 1-hour signed URLs. Public endpoints do not return photos.
• Status and the 20-photo limit are checked again under a row lock on the event, so concurrent uploads cannot exceed it.
• If any photo in a batch fails to store, the photos already uploaded from that batch are deleted. Storage failures return 500 and are logged; validation failures return 422.
• Only event detail and uploads load photos, so other event responses carry no photo URLs.
• The unused /upload stub, util.Upload and its docs page are removed.

Verification

• go test ./... passes. With TEST_DB_DATASOURCE set, a repo test runs two concurrent 15-photo uploads against Postgres and checks that only one succeeds.
• A local run against Postgres with a Logto stub covered permissions, size, type, status, the 25 MB cap, and storage failure (500, no rows written). Migrations ran 7→8, down and up, and on a fresh database.
• Not verified: a real OSS upload. Without keys, only the failure path and the signed URL format were checked.