refactor(uploads): drop legacy multipart code paths

The presigned-URL upload flow (POST /api/uploads/presign + direct B2 POST
+ upload_ids[] in entity creation) is now the only image upload path. The
legacy multipart routes and DTO fields used by older clients are removed:

Removed:
  - POST /api/uploads/image/        (legacy multipart upload → URL)
  - POST /api/uploads/document/     (legacy multipart upload → URL)
  - POST /api/uploads/completion/   (legacy multipart upload → URL)
  - Multipart branch in POST /api/task-completions/ (now JSON-only)
  - CreateTaskCompletionRequest.ImageURLs DTO field
  - UpdateTaskCompletionRequest.ImageURLs DTO field
  - CreateDocumentRequest.ImageURLs DTO field
  - Service-layer ImageURLs loops in task_service.CreateCompletion,
    task_service.UpdateCompletion, document_service.CreateDocument
  - Tests exercising the removed paths
  - Now-unused imports (strings/time/decimal) in task_handler.go

Kept:
  - DELETE /api/uploads/  (orphan-cleanup endpoint, still useful)
  - POST /api/uploads/presign/  (the new path)
  - POST /api/documents/:id/images/  (uses storage_service.Upload directly,
    same multipart pattern but separate code path; deferred for now)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/dto/requests/task.go

@@ -100,7 +100,12 @@ type UpdateTaskRequest struct {
 	ContractorID       *uint            `json:"contractor_id"`
 }
 
-// CreateTaskCompletionRequest represents the request to create a task completion
+// CreateTaskCompletionRequest represents the request to create a task completion.
+//
+// Image attachments arrive via the presigned-URL flow: the client uploads
+// each image directly to B2 (see /api/uploads/presign) and passes the
+// resulting pending_uploads.id values in UploadIDs. The service claims
+// those rows and creates the linked task_completion_image rows.
 type CreateTaskCompletionRequest struct {
 	TaskID      uint             `json:"task_id" validate:"required"`
 	CompletedAt *time.Time       `json:"completed_at"` // Defaults to now
@@ -108,19 +113,6 @@ type CreateTaskCompletionRequest struct {
 	ActualCost  *decimal.Decimal `json:"actual_cost"`
 	Rating      *int             `json:"rating" validate:"omitempty,min=1,max=5"` // 1-5 star rating
 
-	// ImageURLs is the legacy multipart-upload path: the handler uploaded the
-	// images first via the same request and produced URLs. Still supported for
-	// older client builds.
-	ImageURLs []string `json:"image_urls" validate:"omitempty,max=20,dive,max=500"`
-
-	// UploadIDs is the new direct-to-B2 path: the client uploaded each image
-	// via a presigned URL and now claims the resulting pending_uploads rows
-	// by id. The service verifies ownership + size, marks each row claimed,
-	// and creates task_completion_image rows from them.
-	//
-	// If both ImageURLs and UploadIDs are present, both contribute to the
-	// final set of images so a single completion can mix legacy and new
-	// uploads (helps during the rollout window).
 	UploadIDs []uint `json:"upload_ids" validate:"omitempty,max=20"`
 }
 
@@ -129,7 +121,6 @@ type UpdateTaskCompletionRequest struct {
 	Notes      *string          `json:"notes" validate:"omitempty,max=10000"`
 	ActualCost *decimal.Decimal `json:"actual_cost"`
 	Rating     *int             `json:"rating" validate:"omitempty,min=1,max=5"`
-	ImageURLs  []string         `json:"image_urls" validate:"omitempty,max=20,dive,max=500"`
 }
 
 // CompletionImageInput represents an image to add to a completion