refactor(server): use boxstore helpers and file status consts

- Move box ID validation, file listing/pathing, manifest creation, and uploads to `boxstore`
- Use shared helpers for safe filenames and polling interval env parsing
- Add file status constants to `models` to avoid duplicated magic strings across handlersrefactor(server): use boxstore helpers and file status consts

- Move box ID validation, file listing/pathing, manifest creation, and uploads to `boxstore`
- Use shared helpers for safe filenames and polling interval env parsing
- Add file status constants to `models` to avoid duplicated magic strings across handlers

lib/helpers/paths.go

@@ -0,0 +1,47 @@
+package helpers
+
+import (
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+func SafeFilename(name string) (string, bool) {
+	filename := filepath.Base(name)
+	filename = strings.TrimSpace(filename)
+	return filename, filename != "" && filename != "." && filename != string(filepath.Separator)
+}
+
+func SafeChildPath(parent string, filename string) (string, bool) {
+	path := filepath.Join(parent, filename)
+	return path, strings.HasPrefix(path, parent+string(filepath.Separator))
+}
+
+func UniqueFilename(directory string, filename string) string {
+	if _, err := os.Stat(filepath.Join(directory, filename)); os.IsNotExist(err) {
+		return filename
+	}
+
+	extension := filepath.Ext(filename)
+	base := strings.TrimSuffix(filename, extension)
+	for count := 2; ; count++ {
+		candidate := base + "-" + strconv.Itoa(count) + extension
+		if _, err := os.Stat(filepath.Join(directory, candidate)); os.IsNotExist(err) {
+			return candidate
+		}
+	}
+}
+
+func UniqueNameInBatch(filename string, usedNames map[string]int) string {
+	count := usedNames[filename]
+	usedNames[filename] = count + 1
+
+	if count == 0 {
+		return filename
+	}
+
+	extension := filepath.Ext(filename)
+	base := strings.TrimSuffix(filename, extension)
+	return base + "-" + strconv.Itoa(count+1) + extension
+}