feat: add reusable app-file-upload component with drag-and-drop and preview

Replace bare <input type="file"> across all upload locations with a
card-based dropzone component via shared partial. Three visual states:
current server file (thumbnail + Replace/Delete), empty dropzone, and
pending file preview (local FileReader thumbnail + metadata). Delete
actions use data-confirm-message for confirmation dialog.

Centralized as templates/partials/app-file-upload.phtml to prevent
markup drift — documented as deliberate exception to plain-HTML inputs
convention in CLAUDE.md and developer checklist.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -166,6 +166,7 @@ docker/                 # Dockerfiles, Nginx configs, PHP configs
 - New views must handle loading, empty, error, and success states (GR-UI-014)
 - All visible text wrapped in `t('...')`
 - Check existing JS/CSS components before adding new ones (GR-UI-REUSE)
+- **File uploads** use `app-file-upload.phtml` partial (deliberate exception to plain-HTML inputs — the markup is too complex for inline use). See `templates/partials/app-file-upload.phtml` for the `$fileUpload` array contract. Never write file-upload markup inline; always use the partial.
 
 ### Never Do This