feat: maintenance request photo upload/view/delete API (Story 20.4)

[daveharmswebdev]

Summary

• Add MaintenanceRequestPhoto domain entity with S3 presigned URL support for tenant maintenance request photos
• Implement 4 CQRS endpoints: generate upload URL, confirm upload, get photos, delete photo (with primary promotion)
• Tenant property scoping enforced on all handlers — tenants can only manage photos for their assigned property's requests
• 35 unit tests covering happy paths, validation, error cases, and tenant isolation

Acceptance Criteria

• AC-20.4.1: Presigned upload URL scoped to maintenance request photos
• AC-20.4.2: Confirm upload creates MaintenanceRequestPhoto record
• AC-20.4.3: View request returns presigned download URLs for photos
• AC-20.4.4: Entity has required fields (Id, MaintenanceRequestId, S3Key, FileName, ContentType, FileSize, DisplayOrder)
• AC-20.4.5: Photos ordered by DisplayOrder
• AC-20.4.6: Delete removes from S3 and DB, promotes next photo to primary
• AC-20.4.7: EF Core migration with proper FKs and indexes
• AC-20.4.8: Tenant scoping on all endpoints

Test Results

• Backend: 1,814 tests passing (0 failures)
• Frontend: 2,703 tests passing (0 failures)
• E2E: 212/213 passing (1 pre-existing failure, unrelated)

Test plan

• CI passes (backend build + test, frontend build + test)
• Verify new migration applies cleanly on fresh database
• Verify Swagger shows 4 new endpoints under /api/v1/maintenance-requests/{id}/photos

🤖 Generated with Claude Code