feat(upload): support pasting clipboard files

[JustinShetty]

Adds a paste event listener which infers files types for files based on their MIME type, or takes the existing name if it has one already.

---

Summary by cubic

Adds support for pasting files from the clipboard in the upload drop zone, with hardened filename and MIME type handling.

• Listens for paste events and handles any files found in the clipboard.
• Keeps a pasted file's name when it includes an extension; otherwise generates a timestamped name from its MIME type, falling back to .bin.
• Renders file names as plain text to prevent HTML injection.
• Updates the drop zone hint to mention pasting as an option.

^{Written for commit a091048. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 3 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="public/mime-types.js">

<violation number="1" location="public/mime-types.js:39">
P2: When a pasted file has a nonstandard MIME type such as `constructor` or `__proto__`, this inherited-property lookup returns a function/object instead of `bin`, so the generated filename gets an invalid extension and conversion cannot identify its input type. Check that the mapping key is an own property before returning it.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: When a pasted file has a nonstandard MIME type such as constructor or __proto__, this inherited-property lookup returns a function/object instead of bin, so the generated filename gets an invalid extension and conversion cannot identify its input type. Check that the mapping key is an own property before returning it.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At public/mime-types.js, line 39:

<comment>When a pasted file has a nonstandard MIME type such as `constructor` or `__proto__`, this inherited-property lookup returns a function/object instead of `bin`, so the generated filename gets an invalid extension and conversion cannot identify its input type. Check that the mapping key is an own property before returning it.</comment>

<file context>
@@ -0,0 +1,51 @@
+window.inferExtensionFromMimeType = (type) => {
+  const normalizedType = type.toLowerCase();
+  // If it's a known MIME type, return the extension.
+  if (mimeTypeExtensions[normalizedType]) {
+    return mimeTypeExtensions[normalizedType];
+  }
</file context>

Suggested change

	if (mimeTypeExtensions[normalizedType]) {
	if (Object.hasOwn(mimeTypeExtensions, normalizedType)) {