feat(03-02): implement presigned upload flow, quota enforcement, cleanup task

- Replace POST /api/documents/upload with POST /api/documents/upload-url + /{id}/confirm
- upload-url: create pending Document row with user_id=None (Wave 2), return presigned PUT URL
- confirm: stat MinIO for authoritative size (T-03-05), atomic quota UPDATE (T-03-06, STORE-03)
- Confirm returns 413 with {used_bytes, limit_bytes, rejected_bytes} on quota exceeded (STORE-05)
- Wave 2 guard: skip quota UPDATE when doc.user_id is None (Plan 03-03 removes this)
- Add GET /api/auth/me/quota to api/auth.py (STORE-04)
- services/storage.py: remove save_upload (D-04); add GREATEST(0, used_bytes-delta) quota decrement to delete_document (STORE-06)
- tasks/document_tasks.py: add cleanup_abandoned_uploads Celery beat task (D-06)
- celery_app.py: add beat_schedule for cleanup-abandoned-uploads every 30 minutes
- tests/test_documents.py: replace legacy /upload tests with xfail; add real test logic for upload-url/confirm/get-quota
- tests/test_quota.py: implement real test logic with xfail for PostgreSQL-specific SQL

backend/celery_app.py

@@ -11,6 +11,7 @@ safely by the Celery worker process without pulling in the FastAPI application
 machinery.
 """
 import os
+from datetime import timedelta as _timedelta
 
 from celery import Celery
 
@@ -33,5 +34,14 @@ celery_app.conf.task_routes = {
     "tasks.email_tasks.*": {"queue": "email"},
 }
 
+# Celery beat schedule: cleanup_abandoned_uploads runs every 30 minutes (D-06)
+celery_app.conf.beat_schedule = {
+    "cleanup-abandoned-uploads": {
+        "task": "tasks.document_tasks.cleanup_abandoned_uploads",
+        "schedule": _timedelta(minutes=30),
+    },
+}
+celery_app.conf.timezone = "UTC"
+
 # Autodiscover tasks under the `tasks/` package
 celery_app.autodiscover_tasks(["tasks"], force=True)