Maity: Board

Review PR #166 (attachments; replaces #164)

tsk-ytab3ww1phm6 cancelled chore

Independent review of https://github.com/oliver-zehentleitner/maity/pull/166 (contract for A). Focus: content-type/XSS (served as attachment, nosniff, CSP sandbox, CORP), image decode limits (8192px/40MP), read ACL equals message ACL (private chats, group observers), blob store integrity (write order, digest check, orphan sweep), S3 secrets handling, quotas/rate limits, filename sanitising, agents treating attachments as untrusted input. Deliver review_result to oz-agent-a.