feat: add project file system with CRUD, upload, inline editing, and video attachment support

- Add new `/projects/{slug}/files` endpoint group for per-project filesystem operations including directory and file CRUD, upload, and inline editing with public read and owner write access
- Extend attachment system to support video formats (webm, ogv, mov, m4v) with proper file icons and MIME types
- Implement configurable allowed file types via `allowed_file_types` site setting, replacing hardcoded `ALLOWED_UPLOAD_TYPES` with dynamic `allowed_extensions()` and `is_extension_allowed()` functions
- Add `delete_all_project_files()` call in `delete_content_item()` to clean up project files when a project is deleted
- Create database indexes on `project_files` table for `(project_uid, path)` and `(project_uid, parent_path)` to optimize file lookups
- Introduce `docs_prose.py` module with `render_prose()` function that renders Markdown content inside `data-render` divs using mistune, enabling dynamic prose rendering in documentation pages
- Enhance docs search with Markdown-aware text stripping (`_demarkdown()`) and improved HTML/script/style sanitization for better search indexing
- Update documentation API samples to reflect new attachment response fields (`is_image`, `is_video`, `mime_type`) and note video format support
- Update README to document the new project files endpoint and clarify AI gateway attribution for guest Devii sessions

devplacepy/routers/uploads.py

@@ -2,9 +2,9 @@ import logging
 from pathlib import Path
 from fastapi import APIRouter, Request
 from fastapi.responses import JSONResponse
-from devplacepy.database import get_table, get_setting, get_int_setting
+from devplacepy.database import get_table, get_int_setting
 from devplacepy.utils import require_user_api
-from devplacepy.attachments import store_attachment, delete_attachment as _delete_attachment, ALLOWED_UPLOAD_TYPES
+from devplacepy.attachments import store_attachment, delete_attachment as _delete_attachment, is_extension_allowed
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
@@ -20,16 +20,7 @@ async def upload_file(request: Request):
         return JSONResponse({"error": "No file provided"}, status_code=400)
 
     ext = Path(file.filename).suffix.lower()
-    if ext not in ALLOWED_UPLOAD_TYPES:
-        return JSONResponse({"error": f"File type '{ext}' not allowed"}, status_code=415)
-
-    allowed_types_raw = get_setting("allowed_file_types", "").strip()
-    allowed_extensions = set()
-    if allowed_types_raw:
-        for allowed_ext in allowed_types_raw.split(","):
-            allowed_ext = allowed_ext.strip().lower()
-            allowed_extensions.add(allowed_ext if allowed_ext.startswith(".") else f".{allowed_ext}")
-    if allowed_extensions and ext not in allowed_extensions:
+    if not is_extension_allowed(ext):
         return JSONResponse({"error": f"File type '{ext}' not allowed"}, status_code=415)
 
     try: