feat: an unpaid cart's files are kept 2 days, a paid order's 30

Files are uploaded before payment so the price and the security check use
the file itself, but an abandoned cart kept them for 30 days. Now a finished
upload is held 2 days, a quote waiting for review 7, an approved quote 2 more
to be paid, and the paid order keeps its originals for 30 days from upload.
A payment never starts for files that are gone; one under way holds them a
day. Files attached to an order take the order's window.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/api/quotes.py

@@ -7,6 +7,7 @@ from uuid import UUID, uuid4
 from fastapi import APIRouter, Depends, HTTPException
 from psycopg.types.json import Jsonb
 
+from .. import payments
 from ..core import db
 from ..core.auth import owner
 from ..core.models import QuoteRequest
@@ -50,6 +51,9 @@ def create_quote(body: QuoteRequest, session_id=Depends(owner)):
         if row['id'] == uid and reason is None:
             quote_review.approve(c, row, body.items, quote_review.AUTO)
             return {'id': row['id'], 'status': 'approved'}
+        if row['id'] == uid:
+            # An operator reviews it first; the files wait for that review.
+            payments.hold_uploads(c, payments.quote_uploads(draft), payments.REVIEW_HOLD)
     return {'id': row['id'], 'status': 'approved' if row['approved'] else 'pending_review'}
 
 @router.get('/api/quotes/{uid}')