feat: support optional encrypted file content

src/govoplan_files/backend/db/models.py

@@ -16,7 +16,15 @@ def new_uuid() -> str:
 
 class FileBlob(Base, TimestampMixin):
     __tablename__ = "file_blobs"
-    __table_args__ = (UniqueConstraint("tenant_id", "checksum_sha256", "size_bytes", name="uq_file_blobs_tenant_checksum_size"),)
+    __table_args__ = (
+        UniqueConstraint(
+            "tenant_id",
+            "checksum_sha256",
+            "size_bytes",
+            "protection_discriminator",
+            name="uq_file_blobs_tenant_checksum_size_protection",
+        ),
+    )
 
     id: Mapped[str] = mapped_column(String(36), primary_key=True, default=new_uuid)
     tenant_id: Mapped[str] = mapped_column(String(36), nullable=False, index=True)
@@ -25,6 +33,10 @@ class FileBlob(Base, TimestampMixin):
     storage_key: Mapped[str] = mapped_column(String(1000), nullable=False)
     checksum_sha256: Mapped[str] = mapped_column(String(64), nullable=False, index=True)
     size_bytes: Mapped[int] = mapped_column(Integer, nullable=False)
+    protection_discriminator: Mapped[str] = mapped_column(String(320), default="plaintext", nullable=False, index=True)
+    encryption_envelope_id: Mapped[str | None] = mapped_column(String(255), nullable=True, index=True)
+    storage_checksum_sha256: Mapped[str | None] = mapped_column(String(64), nullable=True)
+    storage_size_bytes: Mapped[int | None] = mapped_column(Integer, nullable=True)
     content_type: Mapped[str | None] = mapped_column(String(255))
     ref_count: Mapped[int] = mapped_column(Integer, default=1, nullable=False)
     retained_until: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))