Add document storage (local filesystem) + fix dashboard outstanding KPI

- Local file storage via STORAGE_PATH env var (replaces DO Spaces)
- POST/GET/DELETE /api/cases/:caseId/documents + GET /api/documents/:docId/download
- useDocuments hook + upload/list/download/delete UI in CaseDetailPage
- GET /api/invoices/summary — live SUM of sent+overdue invoices
- Dashboard outstanding KPI wired to real DB value
- api.upload() for FormData, formatBytes() utility

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/server.ts

@@ -7,6 +7,7 @@ import cookie from '@fastify/cookie';
 import helmet from '@fastify/helmet';
 import rateLimit from '@fastify/rate-limit';
 import staticPlugin from '@fastify/static';
+import multipart from '@fastify/multipart';
 import { env, isProd } from './env';
 import { initSentry, captureError } from './lib/sentry';
 import { authPlugin } from './auth/plugin';
@@ -22,6 +23,7 @@ import { adminRoutes } from './routes/admin';
 import { accountRoutes } from './routes/account';
 import { toolUsageRoutes } from './routes/tool-usage';
 import { billingRoutes } from './routes/billing';
+import { documentsRoutes } from './routes/documents';
 import { stripeWebhookRoute } from './routes/webhooks-stripe';
 
 const __filename = fileURLToPath(import.meta.url);
@@ -82,6 +84,8 @@ export async function buildServer() {
     secret: env.SESSION_SECRET,
   });
 
+  await app.register(multipart);
+
   // Global rate limit floor — per-route limits override below.
   await app.register(rateLimit, {
     global: true,
@@ -108,6 +112,7 @@ export async function buildServer() {
   await app.register(accountRoutes);
   await app.register(toolUsageRoutes);
   await app.register(billingRoutes);
+  await app.register(documentsRoutes);
 
   // Serve the built SPA in production. In dev, the Vite dev server runs separately.
   const webDist = env.WEB_DIST_PATH ?? path.resolve(__dirname, '../../web/dist');