Stage 41 — Secure File Access API

Adds /api/v1/files/ for controlled access to existing e-library, lesson note, assignment and classwork attachments. Bearer-token protected, class-scoped for pupil/parent, admin/staff permitted, path traversal blocked, no schema changes.

Test: /upgrade/stage41.php
