docs: add content type handling and upload permissions to Upload plugin documentation

AdminForth/1866/https-claude.aicodeartifact1b9

Author: yaroslav8765

adminforth/documentation/docs/tutorial/09-Plugins/05-0-upload.md

@@ -312,6 +312,37 @@ new UploadPlugin({
 
 
 
+## Content types and who can upload
+
+The content type a file is stored with is derived from its extension on the backend, never taken from the browser. The storage replays that content type when the file is served back, so a client which asks for `text/html` would be able to store a page that executes scripts on your admin origin with the session of whoever opens it.
+
+The plugin knows the common image, video, audio, document, archive and font extensions. If an extension can't be resolved to a content type, no upload URL is issued, and `allowedFileExtensions` is validated at startup, so a typo or an unknown extension fails fast:
+
+```
+Upload plugin can't resolve content type for extension "jpgg". Provide contentTypeByExtension in plugin options
+```
+
+Use `contentTypeByExtension` to add extensions the plugin doesn't know, or to override the built-in mapping:
+
+```ts title="./index.ts"
+new UploadPlugin({
+  ...
+  allowedFileExtensions: ['jpg', 'png', 'dwg'],
+  //diff-add
+  contentTypeByExtension: {
+  //diff-add
+    dwg: 'application/acad',
+  //diff-add
+  },
+})
+```
+
+:::warning
+Mapping an extension to a content type which browsers execute (`text/html`, `image/svg+xml`, `application/xhtml+xml`, ...) allows anyone who can upload files to run scripts on your admin panel origin with the session of the user who opens the file. Only do it if your storage serves files from a separate origin or with `Content-Disposition: attachment`.
+:::
+
+Requesting an upload URL requires permission to write the record the file belongs to: `edit` on the target record when editing an existing one, `create` otherwise. Users who can only view the resource get `403` even if they call the API directly, and `maxFileSize` is enforced on the backend as well, not only in the browser.
+
 ## Image generation
 
 Upload plugin supports AI generation for images. Yo use it you need to install image generation adapter.