fix: use session-aware file creation to avoid nested transactions

files.Create() and files.CreateWithMime() internally create their own
sessions and transactions. When called from within an existing
transaction (now that db.NewSession() auto-begins), this creates nested
transactions that deadlock on SQLite.

Switch to files.CreateWithSession() and files.CreateWithMimeAndSession()
to participate in the caller's existing transaction instead.

pkg/models/project_duplicate.go

@@ -301,7 +301,7 @@ func duplicateProjectBackground(s *xorm.Session, pd *ProjectDuplicate, doer web.
 	}
 	defer f.File.Close()
 
-	file, err := files.Create(f.File, f.Name, f.Size, doer)
+	file, err := files.CreateWithSession(s, f.File, f.Name, f.Size, doer)
 	if err != nil {
 		return err
 	}

pkg/modules/avatar/upload/upload.go

@@ -171,7 +171,7 @@ func StoreAvatarFile(s *xorm.Session, u *user.User, src io.Reader) (err error) {
 	}
 
 	// Save the file
-	f, err := files.CreateWithMime(bytes.NewReader(buf.Bytes()), "avatar.png", uint64(buf.Len()), u, "image/png")
+	f, err := files.CreateWithMimeAndSession(s, bytes.NewReader(buf.Bytes()), "avatar.png", uint64(buf.Len()), u, "image/png", true)
 	if err != nil {
 		return err
 	}

pkg/modules/background/unsplash/unsplash.go

@@ -312,7 +312,7 @@ func (p *Provider) Set(s *xorm.Session, image *background.Image, project *models
 	}
 
 	// Save it as a file in vikunja
-	file, err := files.Create(tmpFile, "", uint64(written), auth)
+	file, err := files.CreateWithSession(s, tmpFile, "", uint64(written), auth)
 	if err != nil {
 		return
 	}