Fix all power-user review issues (FR-01 through FR-12)

FR-01: Fix data directory default from ~/.fieldwitness to ~/.fwmetadata
FR-02/05/07: Accept all file types for attestation (not just images)
  - Web UI, CLI, and batch now accept PDFs, CSVs, audio, video, etc.
  - Perceptual hashing for images, SHA-256-only for everything else
FR-03: Implement C2PA import path + CLI commands (export/verify/import/show)
FR-04: Fix GPS downsampling bias (math.floor → round)
FR-06: Add HTML/PDF evidence summaries for lawyers
  - Always generates summary.html, optional summary.pdf via xhtml2pdf
FR-08: Fix CLI help text ("FieldWitness -- FieldWitness" artifact)
FR-09: Centralize stray paths (trusted_keys, carrier_history, last_backup)
FR-10: Add 67 C2PA bridge tests (vendor assertions, cert, GPS, export)
FR-12: Add Tor onion service support for source drop box
  - fieldwitness serve --tor flag, persistent/transient modes
  - Killswitch covers hidden service keys

Also: bonus fix for attest/api.py hardcoded path bypassing paths.py

224 tests passing (67 new).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontends/web/templates/attest/verify_result.html

@@ -16,10 +16,18 @@
         </div>
         {% endif %}
 
-        {# Query image hashes #}
+        {% if not is_image %}
+        <div class="alert alert-info">
+            <i class="bi bi-info-circle me-2"></i>
+            This file is attested by cryptographic hash. Perceptual matching (pHash, dHash)
+            is available for image files only.
+        </div>
+        {% endif %}
+
+        {# Query file hashes #}
         <div class="card bg-dark border-secondary mb-4">
             <div class="card-header">
-                <h6 class="mb-0"><i class="bi bi-hash me-2"></i>Image Hashes for <code>{{ filename }}</code></h6>
+                <h6 class="mb-0"><i class="bi bi-hash me-2"></i>File Hashes for <code>{{ filename }}</code></h6>
             </div>
             <div class="card-body">
                 <div class="mb-2">
@@ -103,13 +111,13 @@
             <div class="card-body">
                 <p class="text-muted small mb-3">
                     Generate a signed JSON receipt for legal or archival use.
-                    Re-upload the same image to produce the downloadable file.
+                    Re-upload the same file to produce the downloadable receipt.
                 </p>
                 <form action="/verify/receipt" method="post" enctype="multipart/form-data">
               <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
                     <div class="mb-3">
                         <input class="form-control form-control-sm bg-dark text-light border-secondary"
-                               type="file" name="image" accept="image/*" required>
+                               type="file" name="image" required>
                     </div>
                     <button type="submit" class="btn btn-outline-warning btn-sm">
                         Download Receipt (.json)
@@ -121,7 +129,7 @@
 
         <div class="d-grid gap-2 mt-4">
             <a href="/verify" class="btn btn-outline-info">
-                Verify Another Image
+                Verify Another File
             </a>
             <a href="/attest/log" class="btn btn-outline-secondary">
                 View Attestation Log