feat: use authenticated user phone for upload path

@@ -492,7 +492,11 @@ $http_worker->onMessage = function ($connection, $request) use ($config, $authSe
 
             // Generate Key
             $uuid = bin2hex(random_bytes(8));
-            $userPhone = $config['upload']['default_user'];
+
+            // Determine User Phone (Auth > Config)
+            $user = $getUser();
+            $userPhone = $user ? $user['phone'] : $config['upload']['default_user'];
+
             $objectKey = "clawdbot/{$userPhone}/{$uuid}.{$ext}";
             $bucket = $tos_config['bucket'];
 
@@ -548,7 +552,11 @@ $http_worker->onMessage = function ($connection, $request) use ($config, $authSe
             ]);
 
             $uuid = bin2hex(random_bytes(8));
-            $userPhone = $config['upload']['default_user'];
+
+            // Determine User Phone (Auth > Config)
+            $user = $getUser();
+            $userPhone = $user ? $user['phone'] : $config['upload']['default_user'];
+
             // Ensure filename is safe
             $safeName = preg_replace('/[^a-zA-Z0-9._-]/', '', $filename);
             if (!$safeName)