Add file visibility (PRIVATE/PUBLIC) + public files API

Adds a visibility enum to files with PRIVATE (default) and PUBLIC states.
PUBLIC files are accessible via an unauthenticated /api/files/v1/{fileID}
endpoint that redirects to a presigned S3 URL. Introduces pkg/file service
to manage file operations. Logo uploads (trust centers, organizations,
frameworks, references) are marked PUBLIC; other files are PRIVATE.
Includes database migration and backfill for existing logos.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/iam/organization_service.go

@@ -521,6 +521,7 @@ func (s *OrganizationService) CreateOrganization(
 			FileName:   filename,
 			FileKey:    objectKey.String(),
 			FileSize:   req.LogoFile.Size,
+			Visibility: coredata.FileVisibilityPublic,
 			CreatedAt:  now,
 			UpdatedAt:  now,
 		}
@@ -558,6 +559,7 @@ func (s *OrganizationService) CreateOrganization(
 			FileName:   filename,
 			FileKey:    objectKey.String(),
 			FileSize:   req.HorizontalLogoFile.Size,
+			Visibility: coredata.FileVisibilityPublic,
 			CreatedAt:  now,
 			UpdatedAt:  now,
 		}
@@ -698,6 +700,7 @@ func (s *OrganizationService) UpdateOrganization(ctx context.Context, organizati
 			FileName:   filename,
 			FileKey:    objectKey.String(),
 			FileSize:   (*req.LogoFile).Size,
+			Visibility: coredata.FileVisibilityPublic,
 			CreatedAt:  now,
 			UpdatedAt:  now,
 		}
@@ -735,6 +738,7 @@ func (s *OrganizationService) UpdateOrganization(ctx context.Context, organizati
 			FileName:   filename,
 			FileKey:    objectKey.String(),
 			FileSize:   (*req.HorizontalLogoFile).Size,
+			Visibility: coredata.FileVisibilityPublic,
 			CreatedAt:  now,
 			UpdatedAt:  now,
 		}