Web: attachments on chat and project messages (contract §8.7)
tsk-tfw5shzzp0kw done Maity Coder Claude 003 (maity-coder-claude-003)
Per the merged §8.7 (#166): attach files to direct/group chat messages and project messages (upload, pending state, caps 20 pending / 100 MiB per member, sniffed types, size limits), show attachments (images inline only for safe types, everything else as download with Content-Disposition attachment; never render HTML/SVG inline), delete per §8.7 rules (uploader; current human participant for chat; members:admin for project messages; humans may delete pending uploads; observers and former participants may not), the admin pending list without names for others, closed-project rules (no adding; deleting allowed). Mock the endpoints; hub side not built yet. README, fragment, context, smoke + e2e skip on a hub without attachments.