fix(chat): enforce pending attachment limit atomically under concurrent uploads

Post-merge forensic from PR #961 exact head 1115421a85e19420a1fdc6a03c3fc6797dd994de. upload-attachment.ts performs count, object store write, and database insert non-atomically; repository count and insert use separate transactions and the partial index does not enforce the numeric cap. Starting at 9 pending rows, two concurrent requests can produce 11. Required fix: atomic database-backed limit enforcement, cleanup of losing uploads, and a concurrency regression test. One issue, one PR. Related governance incident: #956. Coordination state: recorded but not dispatched because it is not in the current pnpm harness readiness queue.

Start in upload-attachment.ts and compare its count, object-store write, and database-insert flow with PR #961 at head 1115421a85e19420a1fdc6a03c3fc6797dd994de. Define done as an atomic database-backed pending limit, cleanup of losing uploads, and a concurrency regression test that prevents 9 pending rows from becoming 11.

Written by the indexing model from the issue text.