feat(uploads): direct-to-B2 presigned image upload from iOS + Android

iOS (Swift) — primary path, since iOS is the live platform:
  - ImageDownsampler.swift: ImageIO/CGImageSourceCreateThumbnailAtIndex
    based resize. Pays only the cost of the resized bitmap rather than
    decoding the full source — a 12 MP iPhone photo previously
    materialized ~50 MB regardless of JPEG size. Profiles: completion
    (2048 px / quality 0.85), document_image (2560 px / 0.90).
  - PresignedUploader.swift: three-step orchestration (POST /uploads/presign
    → multipart POST direct to B2 with the signed policy fields → return
    upload_id). Maps HTTP errors to user-facing copy. Concurrent uploads
    via TaskGroup.
  - CompleteTaskView.swift: replaces the multipart-with-images path with
    downsample → upload-to-B2 → create-completion-with-upload_ids[]. The
    no-image branch unchanged.

Android (Kotlin) — parity:
  - composeApp/.../media/ImageDownsampler.kt: BitmapFactory inSampleSize
    + proportional scale + JPEG compress. Same profiles as iOS.
  - composeApp/.../network/UploadApi.kt: Ktor-based presign + direct-to-B2
    POST. Preserves form-field order so the S3 policy signature validates.
  - APILayer.uploadImage(category, contentType, bytes, fileName) → upload_id.
    UI integration to follow.

Shared (Kotlin):
  - models/TaskCompletion.kt: added uploadIds: List<Int>? to
    TaskCompletionCreateRequest and a new PresignUploadRequest /
    PresignUploadResponse pair matching the Go API DTOs.
  - Existing call sites (WidgetActionProcessor, PushNotificationManager)
    explicitly pass uploadIds: nil for backwards compatibility — Swift's
    bridge to Kotlin doesn't honor Kotlin defaults for required-positional
    parameters.

The legacy multipart path remains functional alongside the new one for
soak-test purposes; per-platform feature flags can flip between them at
any time. After zero multipart traffic in production for 7 consecutive
days, the legacy paths can be dropped.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

composeApp/src/commonMain/kotlin/com/tt/honeyDue/models/TaskCompletion.kt

@@ -13,6 +13,38 @@ data class TaskCompletionCreateRequest(
     val notes: String? = null,
     @SerialName("actual_cost") val actualCost: Double? = null,
     val rating: Int? = null,  // 1-5 star rating
-    @SerialName("image_urls") val imageUrls: List<String>? = null  // Multiple image URLs
+    @SerialName("image_urls") val imageUrls: List<String>? = null,  // Legacy: URLs returned by /api/uploads/* multipart endpoints
+    @SerialName("upload_ids") val uploadIds: List<Int>? = null      // New: pending_uploads.id values from /api/uploads/presign + direct B2 POST
+)
+
+/**
+ * Presigned upload session — request body for POST /api/uploads/presign.
+ *
+ * Category: "completion" | "document_image" | "document_file"
+ * ContentType: the MIME type the client will upload (must match the policy
+ * exactly when POSTing to B2).
+ * ContentLength: byte count of the upload (server permits ±256 bytes slack).
+ */
+@Serializable
+data class PresignUploadRequest(
+    val category: String,
+    @SerialName("content_type") val contentType: String,
+    @SerialName("content_length") val contentLength: Long
+)
+
+/**
+ * Presigned upload session — response from POST /api/uploads/presign.
+ *
+ * The client uses [uploadUrl] + [fields] to perform a multipart/form-data
+ * POST directly to B2, then passes [id] back in the upload_ids[] field of
+ * the next /api/task-completions/ or /api/documents/ create call.
+ */
+@Serializable
+data class PresignUploadResponse(
+    val id: Int,
+    @SerialName("upload_url") val uploadUrl: String,
+    val fields: Map<String, String>,
+    val key: String,
+    @SerialName("expires_at") val expiresAt: String
 )