Fix security issues: path traversal, typed errors, file validation

- Fix path traversal in file serve endpoint (validate company prefix, block ..)
- Add typed error classes: ValidationError, NotFoundError, ForbiddenError,
  ConflictError, StorageError
- Global error handler catches AppError subclasses with correct status codes
- 4xx logged as warn, 5xx as error with request ID
- File upload validates entityType whitelist, UUID format, category pattern
- Remove fragile string-matching error handling from routes
- Services throw typed errors instead of plain Error
- Health endpoint documented as intentionally public

packages/backend/src/routes/v1/health.ts

@@ -2,6 +2,7 @@ import type { FastifyPluginAsync } from 'fastify'
 import { sql } from 'drizzle-orm'
 
 export const healthRoutes: FastifyPluginAsync = async (app) => {
+  // Intentionally public — no auth. Load balancers, Docker health checks, and monitoring need this.
   app.get('/health', async (request, reply) => {
     let dbStatus = 'disconnected'
     let redisStatus = 'disconnected'