Allow admins to add custom file types in Upload Settings #76
Description
Summary
Add support for administrators to define custom file extensions in Upload Settings, in addition to the current fixed checkbox list.
Problem
The admin UI currently exposes a predefined list of allowed file extensions (checkboxes), but admins cannot add extensions that are not already listed.
Proposed behavior
- Admin can add one or more custom extensions from the UI (e.g. .heic, .psd, .mkv).
- Custom extensions are validated and normalized (trim spaces, lowercase, enforce leading dot).
- Custom extensions persist in config/database and are loaded back into Admin Settings.
- Upload validation uses the union of:
- built-in selected extensions
- admin-defined custom extensions
- Existing Allow all file types toggle behavior remains unchanged.
Validation rules
- Accept only extension-like values (no path separators, no wildcards, no spaces inside token).
- Reject duplicates and invalid entries with a clear UI/API error.
Acceptance criteria
- Admin can add/remove custom file types from Upload Settings.
- Settings save and reload correctly.
- Upload endpoint enforces custom extensions when Allow all file types is disabled.
- Existing allowed types continue to work exactly as before.
- Unit/integration tests cover save/load and upload-validation behavior.