feat(admin): allow editing boxes and deleting individual files

Introduce new admin capabilities to manage uploaded boxes and files:
- Add routes and handlers for editing boxes and deleting individual files.
- Implement `RemoveFileFromBox` in `UploadService` to delete a file's stored objects and remove it from the box (deleting the box if empty).
- Implement `AdminUpdateBox` in `UploadService` to update expiry, download limits, and clear password protection.
- Remove the unused `AdminFiles` handler.
- Add `.claude` to `.gitignore`.

backend/libs/services/upload.go

@@ -613,6 +613,80 @@ func (s *UploadService) DeleteBoxWithSource(boxID, source string) error {
 	return nil
 }
 
+// RemoveFileFromBox deletes a single file's stored objects (and thumbnail) and
+// removes it from the box. If it was the box's last file, the whole box is
+// deleted. Returns whether the box itself was removed.
+func (s *UploadService) RemoveFileFromBox(boxID, fileID string) (bool, error) {
+	box, err := s.GetBox(boxID)
+	if err != nil {
+		return false, err
+	}
+	index := -1
+	for i, file := range box.Files {
+		if file.ID == fileID {
+			index = i
+			break
+		}
+	}
+	if index < 0 {
+		return false, os.ErrNotExist
+	}
+	file := box.Files[index]
+
+	backendID := s.BoxStorageBackendID(box)
+	backend, err := s.storage.Backend(backendID)
+	if err != nil {
+		backend, err = s.storage.BackendForMaintenance(backendID)
+	}
+	if err == nil {
+		if key := s.FileObjectKey(box, file); key != "" {
+			_ = backend.Delete(context.Background(), key)
+		}
+		if key := s.ThumbnailObjectKey(box, file); key != "" {
+			_ = backend.Delete(context.Background(), key)
+		}
+	}
+
+	box.Files = append(box.Files[:index], box.Files[index+1:]...)
+	if len(box.Files) == 0 {
+		if err := s.DeleteBoxWithSource(box.ID, "admin"); err != nil {
+			return false, err
+		}
+		return true, nil
+	}
+	if err := s.SaveBox(box); err != nil {
+		return false, err
+	}
+	s.logger.Info("admin removed file", "source", "admin", "severity", "user_activity", "code", 2305, "box_id", box.ID, "file_id", fileID)
+	return false, nil
+}
+
+// AdminUpdateBox lets an admin change a box's expiry, download limit, and
+// optionally clear password protection.
+func (s *UploadService) AdminUpdateBox(boxID string, expiresAt time.Time, maxDownloads int, removePassword bool) error {
+	box, err := s.GetBox(boxID)
+	if err != nil {
+		return err
+	}
+	if !expiresAt.IsZero() {
+		box.ExpiresAt = expiresAt.UTC()
+	}
+	if maxDownloads < 0 {
+		maxDownloads = 0
+	}
+	box.MaxDownloads = maxDownloads
+	if removePassword {
+		box.PasswordHash = ""
+		box.PasswordSalt = ""
+		box.Obfuscate = false
+	}
+	if err := s.SaveBox(box); err != nil {
+		return err
+	}
+	s.logger.Info("admin updated box", "source", "admin", "severity", "user_activity", "code", 2306, "box_id", box.ID)
+	return nil
+}
+
 func (s *UploadService) FindFile(box Box, fileID string) (File, error) {
 	for _, file := range box.Files {
 		if file.ID == fileID {