fix(backend): harden documents, webhooks, and batch shipments

[Hassan-oladipupo]

Summary

• make document uploads self-cleaning across every failure path
• keep document metadata and disk state consistent during deletion
• cap webhook registrations and delivery fan-out per user
• remove duplicated shipment batch-creation fragments so the backend compiles again

Changes

• add upload cleanup interception, MIME prevalidation, and service-level failure cleanup
• use a tombstone/rollback deletion sequence with safe ENOENT handling
• enforce a configurable WEBHOOK_MAX_PER_USER limit (default 10) with advisory-lock creation and defensive delivery bounds
• retain the current per-item transaction implementation for batch shipment creation

Testing

• npm run build
• 8 focused Jest suites passed (66 tests), including upload integration and concurrent webhook coverage
• npx tsc --noEmit -p tsconfig.build.json
• targeted ESLint/Prettier checks and git diff --check

Closes #1539
Closes #1540
Closes #1541
Closes #1542

[vercel]

@Hassan-oladipupo is attempting to deploy a commit to the Mftee's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Hassan-oladipupo Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits