feat: implement sealed letter protection in backend

backend/letters/views.py

@@ -36,6 +36,10 @@ class LetterDetailView(generics.RetrieveUpdateDestroyAPIView):
         # upsert: create if doesn't exist, else update
         letter, created = Letter.objects.get_or_create(public_id=public_id, user=request.user)
 
+        # check if already sealed
+        if not created and letter.status == Letter.Status.SEALED:
+            return Response({"error": "Sealed letters cannot be modified."}, status=400)
+
         # request.data handles both JSON and Multipart automatically in DRF
         serializer = self.get_serializer(letter, data=request.data, partial=True)
         serializer.is_valid(raise_exception=True)
@@ -43,7 +47,11 @@ class LetterDetailView(generics.RetrieveUpdateDestroyAPIView):
 
         # Note: image_files is a list of binary files in request.FILES
         if "image_files" in request.FILES:
-            letter.images.all().delete()
+            # Delete old image files from storage and database
+            for old_image in letter.images.all():
+                old_image.file.delete(save=False)
+                old_image.delete()
+
             for image_file in request.FILES.getlist("image_files"):
                 LetterImage.objects.create(letter=letter, file=image_file, file_name=image_file.name)