init: 从 /root/zikai 根目录迁入

把原本散落在 /root/zikai 的 FastAPI 服务整理到 server/ 子目录，
开启独立 git 与 venv。运行时数据（config.yaml / keys / uploads）
按 .gitignore 留在工作目录但不入仓。

app/controllers/file_controller.py

@@ -0,0 +1,72 @@
+"""文件上传 / 列表 / 下载接口。"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from fastapi import APIRouter, Depends, File, HTTPException, UploadFile
+from fastapi.responses import FileResponse
+from sqlalchemy.orm import Session
+
+from ..database import get_db
+from ..dao.uploaded_file_dao import UploadedFileDAO
+from ..schemas.file import FileListResponse, FileUploadResponse, UploadedFileOut
+from ..services.upload_service import UploadService
+
+router = APIRouter(prefix="/api/files", tags=["files"])
+
+
+def _service(db: Session = Depends(get_db)) -> UploadService:
+    return UploadService(UploadedFileDAO(db))
+
+
+@router.post(
+    "/upload",
+    response_model=FileUploadResponse,
+    summary="上传单个文件（流式，支持大文件）",
+    description=(
+        "multipart/form-data 上传，按 1 MiB 分片流式落盘，内存占用恒定；"
+        "落盘过程中计算 SHA-256 并入库。\n\n"
+        "极大或极慢的传输建议改用 SFTP（详见 README），HTTP 链路受 Apache 代理 300s 超时限制。"
+    ),
+)
+async def upload_file(
+    file: UploadFile = File(..., description="要上传的文件"),
+    service: UploadService = Depends(_service),
+) -> FileUploadResponse:
+    if not file.filename:
+        raise HTTPException(400, "请求缺少 'file' 字段")
+    return service.stream_to_disk(file, source="http", uploaded_by="anonymous")
+
+
+@router.get("", response_model=FileListResponse, summary="列出已上传的文件")
+def list_files(
+    limit: int = 100,
+    offset: int = 0,
+    service: UploadService = Depends(_service),
+) -> FileListResponse:
+    total, items = service.list_files(limit=limit, offset=offset)
+    return FileListResponse(total=total, items=items)
+
+
+@router.get("/{file_id}", response_model=UploadedFileOut, summary="查询单个文件元数据")
+def get_file(file_id: int, service: UploadService = Depends(_service)) -> UploadedFileOut:
+    out = service.get_out(file_id)
+    if out is None:
+        raise HTTPException(404, "文件不存在")
+    return out
+
+
+@router.get("/{file_id}/download", summary="下载文件")
+def download_file(file_id: int, service: UploadService = Depends(_service)) -> FileResponse:
+    out = service.get_out(file_id)
+    if out is None:
+        raise HTTPException(404, "文件不存在")
+    path: Path | None = service.resolve_disk_path(file_id)
+    if path is None or not path.exists():
+        raise HTTPException(410, "文件实体已不在磁盘上")
+    return FileResponse(
+        path=str(path),
+        media_type=out.content_type or "application/octet-stream",
+        filename=out.original_filename,
+    )