docs(server): chronicle the fileService DI migration

migrate.md

@@ -18,7 +18,7 @@ Wave 2 — cross-cutting leverage (parallel to wave 3, high payoff)
 
 Wave 3 — domain services with existing modules, low fan-in
 
-7. dayNoteService (done 2026-07), tripInviteService (done 2026-07), assignmentService (done 2026-07), shareService (done 2026-07), settingsService (done 2026-07), fileService, collabService, packingService (done 2026-07) — each maps 1:1 to a Nest module that's already a thin delegate; none is imported by more than one
+7. dayNoteService (done 2026-07), tripInviteService (done 2026-07), assignmentService (done 2026-07), shareService (done 2026-07), settingsService (done 2026-07), fileService (done 2026-07), collabService, packingService (done 2026-07) — each maps 1:1 to a Nest module that's already a thin delegate; none is imported by more than one
    other legacy service.
 
 Wave 4 — the coupled cluster (order matters here)

server/src/nest/README.md

@@ -27,8 +27,8 @@ mount to Nest and leaves the sibling trip routes (days, places, ...) on Express.
   categories, tags, notifications, atlas.
 - **Phase 2 (trip sub-domains):** vacay (addon), packing, todo.
 - **DI-native services (legacy `src/services/*` deleted):** tags, categories,
-  todo, packing, day-notes, trip-invite, assignments, share, settings — see the
-  migration recipe below.
+  todo, packing, day-notes, trip-invite, assignments, share, settings, files —
+  see the migration recipe below.
 
 ## Cross-cutting Foundation pieces
 
@@ -118,9 +118,15 @@ fold plus a 3-export `share.bridge.ts` for `mcp/tools/trips.ts`); settings
 followed (no MCP surface, no bridge, and the first migration that converted an
 in-container plain-function consumer into a provider instead of bridging it:
 `llm-parse/llm-config.resolver.ts` became the injectable `LlmConfigResolver`,
-injected by `LlmParseService` and `PluginHostDepsFactory`). Repeat these
+injected by `LlmParseService` and `PluginHostDepsFactory`); files followed (no
+MCP surface and no addon gate; the load-time constants + pure helpers consumed
+by three controllers' module-scope multer configs moved to
+`files.constants.ts`, and `files.bridge.ts` survives with a single export —
+the request-time `getAllowedExtensions` app_settings read those configs need
+outside DI — while every function consumer, including the plugin host and
+`TripsService`, injects `FilesService`). Repeat these
 steps per
-service (next up: fileService). This is a **pure relocation** — byte-identical
+service (next up: collabService). This is a **pure relocation** — byte-identical
 SQL, statuses, bodies, and error strings. The plugin RPC host is **no longer a
 bridge consumer**: since Option A of `src/nest/plugins/DI-MIGRATION.md` it
 injects domain services via `PluginHostDepsFactory`, so a migrated domain adds

server/src/nest/plugins/DI-MIGRATION.md

@@ -105,8 +105,9 @@ factory — it was never imported here; assignments swapped in 2026-07; share
 migrated 2026-07 without touching the factory — it was never imported here
 either; settings swapped in 2026-07 indirectly — the factory never imported it,
 but its `resolveLlmConfig` import became the injected `LlmConfigResolver`;
-next factory swap: whichever Wave-3 domain the factory imports migrates
-next — fileService/collabService are both imported here).
+fileService swapped in 2026-07 — its ten imported symbols became the injected
+`FilesService` plus the load-time constants from `files.constants.ts`; next
+factory swap: collabService, the last Wave-3 domain imported here).
 
 ### Test impact (as landed)
 
@@ -257,7 +258,7 @@ none of it is throwaway.
 | `src/nest/plugins/protocol/envelope.ts` | Single source of truth for methods/permissions — must stay zero-import; B validates against it |
 | `src/nest/plugins/plugin-runtime.service.ts` | The provider that owns the factory call site (supervisor field initializer) |
 | `src/nest/plugins/supervisor/plugin-supervisor.ts` | Sandbox lifecycle — untouched by both options |
-| `src/nest/todo/todo.bridge.ts` | The one surviving bridge — kept only for the legacy `get_trip_summary` MCP registrar |
+| `src/nest/todo/todo.bridge.ts` | Surviving bridge — kept only for the legacy `get_trip_summary` MCP registrar (`src/nest/files/files.bridge.ts` also survives, but for module-scope multer configs, not the plugin host) |
 | `src/mcp/registry-handoff.ts` | The MCP precedent for non-container code — **not needed here**; documented to explain why |
 | `nest-mcp/` (`@trek/nest-mcp`) | The proven decorator/registry/discovery blueprint Option B mirrors |
 | `src/nest/README.md` | The per-service DI migration recipe this roadmap rides on |