feat: support secure downloadable PDF attachments

[farleyt88]

Summary

• allow PDF uploads under the explicit generic-attachment policy
• preserve a sanitized, bounded original filename and render generic files as downloadable Markdown links
• validate final message size before upload and again after attachment assembly
• bind relay upload descriptors to locally computed SHA-256, size, MIME, and canonical same-relay media paths
• reject primary thumbnail URLs and invalid thumbnail paths returned as upload metadata

Verification

• cargo fmt --all -- --check
• cargo test -p buzz-cli — 420 passed
• cargo clippy -p buzz-cli --all-targets -- -D warnings
• cargo build --release -p buzz-cli
• live PDF upload/download round trip — SHA-256 matched (b62d365c744562ecb1fb23bef22742fc082406ad57ebb0e51aa8ade8223d4ea1)

just ci reaches Desktop Tauri clippy but cannot complete on this Linux host because the system gobject-2.0/glib-2.0 development packages are unavailable. The workspace Rust clippy and Desktop frontend checks preceding that step pass.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is eed74bde2f4797714335ac10c56c0b0244c1def4...2c581a59e12c8c8a60578c358fd193ce9fd1ba98.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 2c581a59e12c8c8a60578c358fd193ce9fd1ba98 to authorize a new review.
Any previous review applies only to its recorded range.