Scaffold h4ckath0n OneShot app, implement secure one-time upload flow, and relocate app to repo root

[Copilot]

This PR scaffolds the OneShot full-stack app from the h4ckath0n template and implements the secure one-time upload architecture end-to-end. It also relocates the generated project from oneshot-app/ into repository root (api/, web/) and fixes CI path assumptions accordingly.

• Backend: ID generation + schema for one-shot uploads

  • Added api/app/rng.py with:
    • new_file_id() (32-char base32, f prefix)
    • new_oneshot_token_id() (32-char base32, t prefix)
    • is_file_id() / is_oneshot_token_id() validators
  • Added api/app/uploads/models.py:
    • OneShotToken (id, is_used, created_by_id, optional target_email)
    • FileMetadata (id, original_filename, mime_type, size_bytes, unique token_id)
  • Registered upload models in app startup so tables are created with metadata.

• Backend: secure API flow

  • Added api/app/uploads/router.py and mounted under /api.
  • Implemented POST /api/admin/oneshot-tokens:
    • admin-only dependency (require_admin)
    • optional target_email
    • returns link when email not provided; schedules background email task when provided
  • Implemented POST /api/oneshot/upload:
    • token accepted only via `Authorization: ******
    • atomic one-time lock using SQLAlchemy UPDATE ... WHERE is_used = false ... RETURNING
    • writes upload to LOCAL_UPLOAD_DIR / <new_file_id> with 1MB chunks and no extension
    • persists FileMetadata tied to token
  • Disabled public registration routes via middleware per requirement.

• Frontend: OneShot public upload page

  • Added web/src/pages/OneShotUpload.tsx.
  • Extracts token from window.location.hash (#token=...) on client only.
  • Implements explicit state machine:
    • IDLE | UPLOADING | SUCCESS | ERROR_INVALID_TOKEN | ERROR_UPLOAD_FAILED
  • Upload sends FormData to /api/oneshot/upload with `Authorization: ******
  • 401 maps to explicit “Link Expired” UI.
  • Routed page at /oneshot and exported via pages index.

• Tests for required adversarial/security behavior

  • Added api/tests/test_oneshot.py:
    • verifies new_file_id() format
    • verifies same bearer token cannot upload twice (second call returns 401)
  • Added web/src/pages/__tests__/OneShotUpload.test.tsx:
    • verifies hash token is propagated to Authorization header in upload request

• CI + repository layout alignment

  • Added .github/workflows/ci.yml jobs for:
    • uv run pytest in api/
    • npm run test in web/
  • Relocated scaffold output from oneshot-app/ to root-level api/ and web/ to match repository expectations; updated CI working directories and cache paths accordingly.

# Atomic one-shot token consumption (backend)
stmt = (
    update(OneShotToken)
    .where(OneShotToken.id == token_id, OneShotToken.is_used == False)
    .values(is_used=True)
    .returning(OneShotToken.id)
)
result = await db.execute(stmt)
if result.first() is None:
    raise HTTPException(status_code=401, detail="Invalid or used token")