Secure multi-file upload bounded context.

Locations

Layer	Path
Domain	internal/domain/upload/
Application	internal/application/upload/ — start with service.go
HTTP	internal/adapters/http/handler/upload_handler.go
GoUI	routes.go (upload middleware); bulk notification upload: controller_rbac_notifications.go
Infrastructure	pkg/safefs, internal/infrastructure/storage
Wiring	wire_infra.go, wire_http.go, wire_goui.go

Application

File	Role
service.go	Facade: UploadBatch — validation, virus scan, storage
service_test.go	Unit tests

HTTP surfaces

Method	Path	Handler	Permission
POST	/api/v1/uploads/	Upload	uploads:create

GoUI static file path: gouiupload.UploadPath / FilesPrefix — same permission (uploads:create or notification send).

Panel surfaces

Path	Screen
/dashboard/uploads	uploads
/dashboard/notifications/bulk/upload	notification-upload

Related

• Size limits → SEC_MAX_UPLOAD_BYTES, HTTP_BODY_LIMIT_BYTES
• Architecture → DOMAIN.md