[Feature Request] Agents cannot view image attachments (Blossom media requires NIP-98 HTTP auth)

## Problem

Agents cannot view image attachments that users post in channels. When a user uploads an image, it is stored in the relay's Blossom media store and served via URLs that require **NIP-98 HTTP authentication**. Agents authenticate to the relay over WebSocket using signed Nostr events (`BUZZ_PRIVATE_KEY` / `BUZZ_AUTH_TAG`), but they have no mechanism to produce the NIP-98 HTTP auth headers needed to fetch image URLs directly.

This means agents are effectively blind to any visual content shared in the conversation — screenshots, diagrams, photos, charts — even though users frequently share images expecting agents to see and reason about them.

## Root Cause

- **Image storage**: Files uploaded via `buzz upload file` are stored in the relay's Blossom store, served at URLs like `/blossom/.`
- **Image serving**: Blossom media endpoints require NIP-98 HTTP auth (Authorization header with a signed event)
- **Agent auth**: Agents authenticate via WebSocket using signed Nostr events — they have no HTTP-level auth capability for Blossom endpoints
- **Result**: Any HTTP GET to a Blossom URL from an agent's context returns a 401/403

## Impact

- Agents cannot reason about screenshots, diagrams, or any image content shared by users
- Breaks workflows where users share visual context (error screenshots, UI mockups, charts) expecting agent assistance
- Creates an asymmetry: humans can see images in the Desktop client, but their agent teammates cannot

## Proposed Solutions

Several possible approaches, not mutually exclusive:

1. **Agent-side NIP-98 support**: Give the agent harness/CLI a `buzz media get ` command (or equivalent) that signs a NIP-98 event on the fly and fetches the image. The agent would then receive the image data inline.
2. **Signed/expiring URLs**: When a message contains image attachments, the relay could include a short-lived signed URL that agents can fetch without additional auth.
3. **Inline image data**: For images below a size threshold, embed base64 image data directly in the message event or a companion event that agents can read.
4. **Relay-level agent exemption**: Allow agents with valid channel membership to fetch Blossom media from channels they belong to, using their existing WebSocket auth identity.

## Environment

- Platform: Buzz (all agent types — managed and custom ACP agents)
- Auth: `BUZZ_PRIVATE_KEY` + `BUZZ_AUTH_TAG`
- Media: Blossom store with NIP-98 HTTP auth

---

Posted by Stretch, a Buzz agent, on behalf of @dmnyc.

Start with the `buzz upload file` flow and the agent authentication paths using `BUZZ_PRIVATE_KEY` and `BUZZ_AUTH_TAG`; compare them with Blossom's NIP-98 HTTP requirement. Review the proposed `buzz media get ` approach alongside the other listed solutions, then agree on and validate one path that lets agents fetch image attachments.

Written by the indexing model from the issue text.