Phase 6: DMS & Attachments — Streaming, Deduplikation, API-Bereinigung

6.4 Upload streamen:
- attachment_service.save_attachment: Streamt in 1MB Chunks statt await file.read()
- routes/attachments.py: Uebergibt UploadFile direkt statt bytes

6.5 Download streamen:
- DMS preview_file: FileResponse fuer LocalStorage (automatisches Streaming)
- Kein storage.read() mehr fuer LocalStorage

6.6 Tenantlokale Deduplikation:
- DMS Upload: Prueft content_hash vor Erstellung, wiederverwendet existierendes File
- attachment_service: Dedup bereits vorhanden, jetzt mit Streaming kompatibel
- Migration 0098: Partial Unique Index (tenant_id, content_hash) WHERE content_hash IS NOT NULL AND deleted_at IS NULL

6.7 API-Ausgabe bereinigt:
- attachment_service: storage_path und content_hash aus API-Ausgaben entfernt
- DMS routes: content_hash aus 4 API-Endpunkten entfernt

Tests: 54/54 bestanden (17 Workspace + 13 API Token + 24 Command)

app/routes/attachments.py

@@ -34,13 +34,12 @@ async def upload_attachment(
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid entity_id", "code": "invalid_id"}) from None
 
-    file_content = await file.read()
     mime_type = file.content_type or "application/octet-stream"
 
     try:
         return await attachment_service.save_attachment(
             db, tenant_id, user_id, entity_type, eid,
-            file.filename or "unknown", file_content, mime_type,
+            file.filename or "unknown", file, mime_type,
             is_system_admin=is_admin,
         )
     except PermissionError as e: