feat(backend): add POST /api/documents/{id}/file endpoint to attach file to existing document

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/test/java/org/raddatz/familienarchiv/controller/DocumentControllerTest.java

@@ -563,6 +563,36 @@ class DocumentControllerTest {
                 .andExpect(status().isBadRequest());
     }
 
+    // ─── POST /api/documents/{id}/file ───────────────────────────────────────
+
+    @Test
+    @WithMockUser
+    void attachFile_returns403_whenMissingWritePermission() throws Exception {
+        org.springframework.mock.web.MockMultipartFile file =
+                new org.springframework.mock.web.MockMultipartFile("file", "brief.pdf", "application/pdf", new byte[]{1});
+
+        mockMvc.perform(multipart("/api/documents/" + UUID.randomUUID() + "/file").file(file))
+                .andExpect(status().isForbidden());
+    }
+
+    @Test
+    @WithMockUser(authorities = "WRITE_ALL")
+    void attachFile_returns200_withUpdatedDocument_whenHasWritePermission() throws Exception {
+        UUID id = UUID.randomUUID();
+        Document doc = Document.builder()
+                .id(id).title("Brief").originalFilename("brief.pdf")
+                .filePath("docs/brief.pdf").status(DocumentStatus.UPLOADED).build();
+        when(documentService.attachFile(eq(id), any())).thenReturn(doc);
+
+        org.springframework.mock.web.MockMultipartFile file =
+                new org.springframework.mock.web.MockMultipartFile("file", "brief.pdf", "application/pdf", new byte[]{1});
+
+        mockMvc.perform(multipart("/api/documents/" + id + "/file").file(file))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.id").value(id.toString()))
+                .andExpect(jsonPath("$.status").value("UPLOADED"));
+    }
+
     // ─── GET /api/documents/{id}/versions/{versionId} ────────────────────────
 
     @Test