feat: an unpaid cart's files are kept 2 days, a paid order's 30

Files are uploaded before payment so the price and the security check use
the file itself, but an abandoned cart kept them for 30 days. Now a finished
upload is held 2 days, a quote waiting for review 7, an approved quote 2 more
to be paid, and the paid order keeps its originals for 30 days from upload.
A payment never starts for files that are gone; one under way holds them a
day. Files attached to an order take the order's window.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/quote_review.py

@@ -18,6 +18,7 @@ from decimal import Decimal
 from fastapi import HTTPException
 from psycopg.types.json import Jsonb
 
+from . import payments
 from .core.pricing import price
 from .runtime import freight, upload_row
 from .scanning import require_clean
@@ -83,4 +84,6 @@ def approve(c, row, items, reviewer):
                 'total_cents': sum(i['total_cents'] for i in priced) + quoted_freight['total_cents']}
     c.execute('UPDATE dtf_local.quotes SET approved=%s, reviewed_by=%s, approved_at=now() WHERE id=%s',
               (Jsonb(approved), reviewer, row['id']))
+    # Approved and payable now: the files wait for the payment, not for ever.
+    payments.hold_uploads(c, payments.quote_uploads(approved), payments.UNPAID_HOLD)
     return approved