Locations

Layer	Path
Domain	`internal/domain/upload/`
Application	`internal/application/upload/` — start with`service.go`
HTTP	`internal/adapters/http/handler/upload_handler.go`
GoUI	`routes.go` (upload middleware); bulk notification upload: `controller_rbac_notifications.go`
Infrastructure	`pkg/safefs`, `internal/infrastructure/storage`
Wiring	`wire_infra.go`, `wire_http.go`, `wire_goui.go`

Application

File	Role
`service.go`	Facade: `UploadBatch` — validation, virus scan, storage
`service_test.go`	Unit tests

Method	Path	Handler	Permission
POST	`/api/v1/uploads/`	Upload	`uploads:create`

GoUI static file path: gouiupload.UploadPath / FilesPrefix — same permission (uploads:create or notification send).

Path	Screen
`/dashboard/uploads`	`uploads`
`/dashboard/notifications/bulk/upload`	`notification-upload`