revert: restore production to the state before 730d0bd (PM/RBAC work moved to 'pm')

Their three commits (730d0bd, 5a9b543, 387edfb) reached production by push and
auto-deployed. 387edfb expects a users.username column that the live database does
not have, so POST /api/v1/auth/login was returning HTTP 500. Their schema changes
never applied either (projects still has only id, name, description, start_date,
pm_user_id, created_at), so nothing depends on the reverted code.

This commit sets the tree back to exactly a02b3ea — verified with git diff against
it — while keeping history linear: the work itself is preserved on 'pm' at 387edfb.

backend/app/routers/files.py

@@ -29,10 +29,9 @@ from app.utils.preview_token import make_preview_token, verify_preview_token
 
 router = APIRouter(prefix="/quotes", tags=["files"])
 
-# حذف و بارگذاری پیوست‌ها = عملیات تدارکات (ادمین / مدیر تدارکات)؛ دانلود
+# حذف پیوست‌ها = عملیات تدارکات (ادمین / مدیر تدارکات)؛ بارگذاری و دانلود
 # برای هر کاربر واردشده آزاد است.
 _attachment_deleter = require_role("procurement_manager", "admin")
-_attachment_writer = require_role("procurement_manager", "admin")
 
 ALLOWED_MIME_TYPES = {
     "image/png", "image/jpeg", "image/webp", "image/gif", "application/pdf",
@@ -126,7 +125,7 @@ async def _attachment_or_404(
 # Invoice — قابل بارگذاری در هر وضعیتی (از صفحه‌ی ویرایش)
 # ---------------------------------------------------------------------------
 
-@router.post("/{quote_id}/invoice", status_code=201, dependencies=[Depends(_attachment_writer)])
+@router.post("/{quote_id}/invoice", status_code=201, dependencies=[Depends(get_current_user)])
 async def upload_invoice(quote_id: uuid.UUID, file: UploadFile = File(...), db: AsyncSession = Depends(get_db)):
     await _quote_or_404(db, quote_id)
     mime = _validate_upload(file)
@@ -209,7 +208,7 @@ async def delete_invoice(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: Asyn
 # Proforma — no status restriction
 # ---------------------------------------------------------------------------
 
-@router.post("/{quote_id}/proforma", status_code=201, dependencies=[Depends(_attachment_writer)])
+@router.post("/{quote_id}/proforma", status_code=201, dependencies=[Depends(get_current_user)])
 async def upload_proforma(quote_id: uuid.UUID, file: UploadFile = File(...), db: AsyncSession = Depends(get_db)):
     await _quote_or_404(db, quote_id)
     mime = _validate_upload(file)