Jodit sends files as files[0], files[1], ... (from filesVariableName(i)
returning `files[${i}]`), not files[] as previously assumed. The buildData
callback only matched "files[]" so the actual file field was passed
through as-is, triggering MulterError: Unexpected field because backend
multer.single("file") only accepts a field named "file".

Fix buildData to:
- Match files[0], files[1], ... pattern and convert first file to "file"
- Drop extra files (multer.single only accepts one)
- Drop Jodit-internal fields (source, extension, mimetype) backend ignores

Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

The Jodit uploader was posting to /files but the backend route is
/api/v1.0/file/upload (auto-mounted from controllers/api/v1.0/file/
upload.ts). This caused a 404 when uploading images from the editor.

Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Use JoditEditor's editorRef callback to attach the native paste listener
to the correct HTMLElement (jodit.editor) instead of casting the IJodit
instance to HTMLElement, which caused "t.addEventListener is not a
function" runtime error.

Also resolve uploaded image URLs via resolveUploadUrl so previews render
inside the editor, and ignore the Windows reserved-name "nul" file.

Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Resolve orval.config.ts conflict: keep committed openapi spec
prioritized before HTTP fallbacks so CI uses deterministic spec.
Update openapi/swagger-output.json with latest backend spec including
forgot-password/request, role, user/{id}/{status,reset-password,role}.

Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>