Attachment abuse controls and safety limits

## Summary
Implement attachment abuse controls and safety limits for self-hosted deployments.

## Scope
- Enforce file size, type, count, and rate limits for uploads.
- Add controls for dangerous or unwanted file types and oversized media.
- Provide moderator/admin controls for attachment policy where it changes product behavior.
- Make blocked-upload outcomes clear to end users.

## Acceptance Criteria
- [ ] Upload limits are enforced server-side and explained clearly in the UI.
- [ ] Disallowed or suspicious file types are blocked consistently.
- [ ] Operators can configure the core safety limits without code changes.
- [ ] Abuse controls apply across all attachment entry points.

## Operational Notes
- Self-hosted communities may have very different threat models, so defaults and configuration both matter.
- This issue should stay focused on safety/limits, not the full attachment UX.