Attachments, uploads, and media previews

## Summary
Implement core message attachments, uploads, and media previews with Discord-like behavior for a single-guild deployment.

## Scope
- Allow users with permission to attach files to messages.
- Support inline previews for common images and media plus sensible file cards for unsupported formats.
- Support upload, download, open-in-new-tab, and failure states.
- Respect channel and permission rules for who can attach and view files.

## Acceptance Criteria
- [ ] Users can attach files while composing a message and see upload progress or failure feedback.
- [ ] Images preview inline in the transcript; unsupported files render as download/open cards.
- [ ] Attachment permissions are enforced consistently in UI and server-side message creation paths.
- [ ] Attachments remain durable and retrievable after page reloads and reconnects.

## Operational Notes
- Storage and URL generation must work for self-hosted local-disk and object-storage backends.
- Size and type limits must be explicit and user-visible.