feat(frontend): upload expenditure receipts for real

[nourshoreibah]

ℹ️ Issue

The last of the frontend's simulated data. Stacked on #306 — base that branch, not main.

📝 Description

FileUpload animated a progress bar over a setInterval that counted through the file's size in 15 ticks, under a standing TODO: update to use real progress of uploaded file. Nothing was ever transferred: the File went into component state and was dropped on submit, so every expenditure was recorded with receipt_url NULL — despite the form refusing to submit without a receipt.

Submitting the form now:

1. Requests a presigned PUT from GET /expenditures/upload-url (added in feat(expenditures): presigned S3 uploads for expenditure receipts #306) for the chosen project and the dropped filename.
2. Sends the file straight to S3 with real byte progress.
3. Passes the returned objectUrl to POST /expenditures as receiptUrl.

If the upload fails, no expenditure is recorded and the error is surfaced — previously a failure was impossible because there was no upload.

Why the upload moved to submit rather than staying on drop: the presigned URL is per project, and the project may not be chosen when the file lands; and a file dropped into a form the user then abandons would leave an orphaned object in the bucket. The user still sees real progress, now while saving. FileUpload becomes controlled — it reports the dropped file immediately (so FilePreview still appears at once) and renders whatever progress its parent passes down.

src/lib/upload.ts — putWithProgress uses XMLHttpRequest because fetch exposes no upload progress. Two details worth a look:

• It sends the content type the URL was signed with, not file.type. S3 checks Content-Type against the signature, so a mismatch is a 403.
• It sends no Authorization header. The signature is in the URL, and an extra header would not be part of what was signed.

✔️ Verification

In apps/frontend, all green:

• npm run typecheck — clean
• npm run lint — clean
• npx jest — 260 passed, 2 skipped, 25 suites
• npm run build — static export succeeds

Coverage:

• New test/lib/upload.test.ts (7) drives a stand-in XHR: the PUT's method/URL/content type, the absence of an auth header, progress reporting, ignoring non-computable progress events, and rejection on non-2xx (carrying the status), network error, and abort.
• AddExpenseModal.test.tsx — asserts the upload URL is requested for the right project and filename, that receiptUrl reaches the POST body, that the PUT uses application/pdf, that the upload strictly precedes the POST, and that a failed upload records nothing and calls no onSuccess.
• FileUpload.test.tsx — replaces the two fake-timer tests for the simulated upload with the controlled-progress behaviour: onChange fires immediately on drop, no progress bar appears on drop, real transferred bytes render as a percentage, and clearing progress returns to the preview.

🏕️ (Optional) Future Work / Notes

• Merge feat(expenditures): presigned S3 uploads for expenditure receipts #306 first, or GET /expenditures/upload-url 404s.
• The existing expenditures list has no receipt column, so uploaded receipts are not yet viewable anywhere — worth a follow-up now that receipt_url will actually be populated.

🤖 Generated with Claude Code

[nourshoreibah]

⚠️ No CI will run on this PR while it is stacked. The workflows trigger on pull_request: branches: [main, develop], which matches the base branch — so a PR based on a feature branch gets no checks at all, including the frontend-ci / lambda-tests / terraform-plan-summary that branch protection requires.

GitHub retargets this to main automatically once the parent merges and its branch is deleted; CI runs from that point. Until then the verification in the description is local only (typecheck, lint, full jest suite, production build — all green).