feat: manage files via manifestattachment with auth and cascade trigger, format API.md method signatures

src/store/manifestattachment/resolveManifestAccess.js

@@ -0,0 +1,22 @@
+import { CHECK_MANIFEST_ACCESS } from '../../sql/manifestattachment.js';
+import request from '../request.js';
+
+/** Ensure manifest belongs to company. Throws Manifest not found. */
+export default function resolveManifestAccess(pool) {
+  return async (companyId, manifestId, tx) => {
+    if (!Number.isFinite(manifestId)) {
+      throw new Error('Manifest not found');
+    }
+
+    const result = await request(pool, tx)
+      .input('manifestId', manifestId)
+      .input('companyId', companyId)
+      .query(CHECK_MANIFEST_ACCESS);
+
+    const row = result.recordset[0];
+    if (!row) {
+      throw new Error('Manifest not found');
+    }
+    return row;
+  };
+}