Integrate Obfuscator file picker into Contracts

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

tests/test_upload_refs.py

@@ -0,0 +1,69 @@
+import os
+import sys
+
+from flask import Flask
+
+_REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+
+
+def test_sink_receives_contract_metadata_without_creating_session(monkeypatch):
+    from upload.backend.upload_refs import blueprint
+
+    calls = []
+
+    class FakeHttpClient:
+        def __init__(self, **_kwargs):
+            pass
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *_args):
+            return False
+
+        def delete(self, _url):
+            return None
+
+    def sink(name, content, **metadata):
+        calls.append((name, content, metadata))
+        return {"ok": True, "doc_id": "doc-1"}
+
+    def unexpected_create_session():
+        raise AssertionError("sink mode must not create a session")
+
+    monkeypatch.setattr(blueprint.httpx, "Client", FakeHttpClient)
+    monkeypatch.setattr(blueprint, "pull_file", lambda *_args, **_kwargs: b"document")
+    monkeypatch.setattr(blueprint, "create_session", unexpected_create_session)
+
+    app = Flask(__name__)
+    app.register_blueprint(blueprint.create_upload_refs_blueprint(
+        {"apiPrefix": "/api", "vmUploadPrefix": "https://vm.example/uploads/"},
+        sink=sink,
+    ))
+
+    response = app.test_client().post("/api/upload_refs", json={
+        "batch_id": "batch-1",
+        "contract_id": "contract-1",
+        "zip_source": "folder/archive.zip",
+        "files": [{
+            "name": "agreement.pdf",
+            "size": 8,
+            "url": "https://vm.example/uploads/token",
+        }],
+    })
+
+    assert response.status_code == 200
+    assert response.get_json()["results"] == [
+        {"name": "agreement.pdf", "ok": True, "doc_id": "doc-1"}
+    ]
+    assert calls == [(
+        "agreement.pdf",
+        b"document",
+        {
+            "batch_id": "batch-1",
+            "contract_id": "contract-1",
+            "zip_source": "folder/archive.zip",
+        },
+    )]