[Improvement]: Comments: attachments

Parent PRD

#783

What to build

Add file attachments to comments. New table comment_attachments: id (UUID PK), comment_id (FK → comments.id, indexed), filename, content_type, size_bytes, storage_path (Databricks Volume path), created_by, created_at. Blobs live under a deterministic Volume path keyed by comment id, reusing the Volume storage model established for DocumentMetadataDb. Add a server-mediated multipart upload endpoint plus list/download/delete, under the existing comments feature permission. Validate against a content-type/extension allowlist (images: png/jpg/gif/webp; docs: pdf/csv/txt/xlsx/docx), a per-file size cap (default 25 MB), and a per-comment count cap (default 10); rejections return a clear error. Caps/allowlist are settings-driven. No AV scan in v1 (no scanner service — documented v2 follow-up). Downloads served with Content-Disposition: attachment, never rendered inline as HTML. Lifecycle: soft-delete (reply tombstone or root cascade) keeps blobs and rows (recoverable); hard-delete (admin) removes rows and blobs. Frontend: upload/preview UI (attachment chips) on sidebar and embedded variants, gated by a comments.attachments feature flag; flag off ⇒ endpoints unavailable and attach affordance hidden.

See PRD sections "Solution" (attachments), "Implementation decisions" (attachments model), "Further notes" (attachment safety posture), and user stories 22–26.

Acceptance criteria

• Migration adds comment_attachments table (+ ix_comment_attachments_comment)
• Multipart upload writes blob to a deterministic Volume path keyed by comment id and records a row
• Upload rejects oversized file, over-count comment, and disallowed type with clear errors
• Allowlist and caps are settings-driven
• Download served as Content-Disposition: attachment, never inline HTML
• List/download respect the comment's (thread-root) audience
• Soft-delete keeps blobs + rows; hard-delete reclaims blobs + rows
• comments.attachments flag gates endpoints + UI; flag off hides attach affordance
• Attachment chips render on sidebar and embedded variants
• Pytest (route) covers accept-within-caps, reject oversized/over-count/disallowed, soft- vs hard-delete blob lifecycle (storage boundary mocked), audience-respecting list/download

Blocked by

None strictly, but sequence last per PRD ship order (resolve/close → threading → rich text → attachments); audience-respecting list/download aligns with thread-root audience from #785.

User stories addressed

22, 23, 24, 25, 26

Start with the PRD sections named in the issue, then inspect the existing comments feature, its permission and feature-flag handling, and the Volume storage model established for DocumentMetadataDb. Review the route-level Pytest coverage and the thread-root audience behavior from #785. Done means all listed migration, upload, validation, lifecycle, audience, flag, UI, and test acceptance criteria pass.