fix(files): purge files and refund quota per tenant

[iammukeshm]

Root cause

PurgeOrphanedFilesJob and PurgeDeletedFilesJob are Hangfire recurring jobs registered without a tenant, so they run with no Finbuckle tenant context. They got by with IgnoreQueryFilters(), but:

1. Tenants with a dedicated database were never purged. With no tenant resolved, FilesDbContext connects to the default database, so only rows (and blobs) in the shared database were cleaned.
2. The storage-quota refund was lost. PurgeDeletedFilesJob called quotas.RecordAsync("", ...). Both quota backends (InMemoryQuotaService, RedisQuotaService) key counters by the explicit tenantId and ThrowIfNullOrWhiteSpace on it, so the call threw, the catch logged a warning, and no tenant got its bytes back.

Failing tests on main (before the fix):

Failed PurgeJobsPerTenantTests.PurgeDeletedFilesJob_Should_PurgeAndRefundQuota_InEveryTenant_IncludingDedicatedDatabase
  Shouldly.ShouldAssertException : await quotas.GetCurrentAsync(tenantId, QuotaResource.StorageBytes)
    should be 0L but was 256L
  Additional Info: the purged bytes must be refunded to tenant 'root'

Failed PurgeJobsPerTenantTests.PurgeOrphanedFilesJob_Should_PurgeExpiredPendingUploads_InEveryTenant_IncludingDedicatedDatabase
  Shouldly.ShouldAssertException : await RowExistsIgnoringFiltersAsync(tenantId, id)
    should be False but was True
  Additional Info: expired pending upload in tenant 'files-orph-dedicated-f1a2f0a5' must be hard-purged

Failed!  - Failed: 2, Passed: 0, Skipped: 0, Total: 2

Fix

Same pattern as #1406 / #1413 (AuditRetentionJob):

• Both jobs load every tenant via IMultiTenantStore<AppTenantInfo>.GetAllAsync(), open a scope per tenant, set IMultiTenantContextSetter, and resolve FilesDbContext in that scope, so a dedicated-database tenant is purged in its own database.
• IgnoreQueryFilters() is narrowed to IgnoreQueryFilters([QueryFilters.SoftDelete]). The tenant filter stays on.
• PurgeDeletedFilesJob refunds StorageBytes under tenant.Id. The refund now runs after the rows are deleted, so a failed delete can't refund bytes that are still stored.
• Each tenant is wrapped in try/catch with a log (OperationCanceledException is not caught), so one unreachable tenant database doesn't block the rest.
• Registration (FilesModule.MapEndpoints) is unchanged. src/BuildingBlocks is untouched.

Tests

New Integration.Tests/Tests/Files/PurgeJobsPerTenantTests.cs. It seeds purgeable files over the real HTTP upload flow (RustFS + Postgres) in three tenants: root, a shared-database tenant, and a dedicated-database tenant (its own Postgres database on the test container, provisioned by the normal tenant-provisioning flow). It then runs each job from a fresh scope with no tenant, which is how Hangfire runs it, and asserts:

• rows are hard-deleted and blobs are removed in every tenant (orphaned pending uploads and soft-deleted files past retention)
• each tenant's StorageBytes quota counter goes back to 0, and nothing is recorded under an empty tenant id

Quota is disabled in the integration harness, so the test gives the job a real InMemoryQuotaService and replays the finalize debit on it.

Results:

• dotnet build src/FSH.Starter.slnx: 0 warnings, 0 errors
• Files integration tests: 60/60 passed (includes the 2 new ones)
• Files.Tests: 23/23 passed · Architecture.Tests: 55/55 passed

Closes #1418

🤖 Generated with Claude Code