Render Markdown and HTML attachments in the client instead of download-only

**Motivation**

Agents hand a lot of their output to people as `.md` and `.html` files — a report, a comparison table, a small dashboard. In Buzz those arrive as a generic file card with a download button. To read a Markdown file an agent just produced, you download it and open a different app, then come back to the thread. That breaks the flow badly enough that agents fall back to pasting long content into the message body or posting a PNG screenshot instead.

**Proposed solution**

Render these two attachment types in the client instead of only offering a download:

- **Markdown**: preview inline with the same renderer the message body already uses, collapsed past a few lines with an expand action.
- **HTML**: an opt-in, sandboxed preview (no scripts / no network, or a strict CSP), similar to the artifact previews other assistant tools offer. A click-to-render step rather than automatic rendering would be a reasonable default.

**Alternatives considered**

- Pasting the content into the message: fine for a paragraph, unusable for a long document, and it loses the file.
- PNG screenshots of the rendered output: no selectable text, no working links, no accessibility.
- Leaving it as download-only: works, but every read costs a round trip out of the app.

**Additional context**

Closest existing issue: #4400 — a safe upload/serving path for agent-generated HTML previews. That one is about getting HTML in and served safely; this one is about showing it (and Markdown) in the client once it is there. Related on the upload side: #3083.