Add signed URLs for file access, fix unauthorized file viewing

New /files/signed-url/:id endpoint generates a 15-minute JWT-signed URL
for any file. New /files/s/* endpoint serves files using the token from
the query string without requiring auth headers. This allows files to
open in new browser tabs without authentication issues. Photos and
documents in repair tickets now use signed URLs when clicked.

packages/admin/src/components/repairs/ticket-photos.tsx

@@ -7,6 +7,15 @@ import { Button } from '@/components/ui/button'
 import { FileText, ImageIcon, Plus, Trash2 } from 'lucide-react'
 import { toast } from 'sonner'
 
+async function openSignedFile(fileId: string) {
+  try {
+    const res = await api.get<{ url: string }>(`/v1/files/signed-url/${fileId}`)
+    window.open(res.url, '_blank')
+  } catch {
+    toast.error('Failed to open file')
+  }
+}
+
 interface FileRecord {
   id: string
   path: string
@@ -145,27 +154,22 @@ function PhotoSection({
             return (
               <div key={photo.id} className="relative group">
                 {isPdf ? (
-                  <a
-                    href={`/v1/files/serve/${photo.path}`}
-                    target="_blank"
-                    rel="noopener noreferrer"
-                    className="h-20 w-20 rounded-md border flex flex-col items-center justify-center bg-muted hover:bg-muted/80 transition-colors"
+                  <button
+                    type="button"
+                    onClick={() => openSignedFile(photo.id)}
+                    className="h-20 w-20 rounded-md border flex flex-col items-center justify-center bg-muted hover:bg-muted/80 transition-colors cursor-pointer"
                   >
                     <FileText className="h-6 w-6 text-muted-foreground" />
                     <span className="text-[9px] text-muted-foreground mt-1 px-1 truncate max-w-full">{photo.filename}</span>
-                  </a>
+                  </button>
                 ) : (
-                  <a
-                    href={`/v1/files/serve/${photo.path}`}
-                    target="_blank"
-                    rel="noopener noreferrer"
-                  >
+                  <button type="button" onClick={() => openSignedFile(photo.id)}>
                     <img
                       src={`/v1/files/serve/${photo.path}`}
                       alt={photo.filename}
                       className="h-20 w-20 object-cover rounded-md border cursor-pointer hover:opacity-80 transition-opacity"
                     />
-                  </a>
+                  </button>
                 )}
                 <button
                   type="button"