A file reference is an id, and nothing here forms an address

[kisielewski]

Four answers named a file by where to fetch it — AttachmentDto,
ProblemFileDto, InstanceLogoDto, InstanceFontDto — each carrying
/api/v1/files/<id>, relative to this Server's own origin.

That is correct for the Server and wrong in every <img src> that receives it:
an application served from anywhere else asks itself for the bytes and is
answered with its single-page shell, 200 text/html where a PNG was wanted. The
figures in four imported statements were blank, and nothing anywhere said why.

The five shapes that already carried a fileId — StatementRefDto,
SubmissionFileDto, ActivityDocumentRefDto, InstanceDocumentRefDto,
InstanceThemeDto — were never affected. That is why a statement's text
rendered on the same page as its blank figure: the text is fetched by id.

What changes

Those four carry FileId and no Url, and the four
$"/api/v1/files/{…}" interpolations go with it. The Server forms no file
address at all, so the question of what origin one is relative to does not
arise. Projections.Attachment and ManagedVersion lose the parameter they
took for it.

Input DTOs are untouched — NewStatementDto, NewProblemFileDto,
NewProblemPackageDto and the instance inputs have always named a fileId, and
an address in a request would be a second name for a thing that has one.

Two commits on purpose: the first adds FileId beside Url, which is
additive and breaks nothing; the second removes Url. Pairs with
AlgoJudge/AlgoJudge-Client#… , which reads the id.

One thing this fixes that was not the subject

ProblemService had a second call site passing _ => null for the address, so a
manager who had just published a version received a file list with no
addresses at all and the preview said the files were not stored. Both call
sites now answer with the id.

Verification

dotnet build -warnaserror clean, 823 tests pass, openapi.json
regenerated from the container.

Two tests changed with the contract, and one of them was named for it:
A_declared_face_reaches_the_reader_as_an_address is now
…_as_a_reference, and asserts both halves — the fileId is the file, and
there is no url property at all.

Measured on a live stack (AlgoJudge-Client beside this Server, the
demonstration bundle imported through the manager's import screen): all four
statement figures answer 200 image/png with a decoded width, fetched from the
Server's own origin. Measured again on the production topology — a page on
algojudge.test drawing from api.algojudge.test, two hostnames on one
registrable domain, as algojudge.app and api.algojudge.app will be — and all
four drew there too.