feat(web): add bounded attachment admission rules

[seekskyworld]

Problem

Implements the admission-contract slice of #344. Web attachments had no shared, testable bounds for count, filename, MIME, per-file size, or aggregate size.

Value

Future file/image upload paths can fail closed before touching workspace or Session authority.

Approach

Add a pure protocol validator with explicit supported MIME types, filename traversal protection, count and UTF-8-independent byte limits. No upload storage or prompt behavior is changed.

Validation

• node --test --experimental-strip-types tests/web/attachments.test.ts
• npx tsc --noEmit
• git diff --check

Impact

• User-visible behavior: establishes bounded attachment admission errors for future UI.
• Model-visible context/tools: none.
• Runtime/lifecycle: none.
• Persisted config/data: none.
• Compatibility/risk: additive protocol utility; upload flow remains unimplemented.

[tt-a1i]

准入边界是对的，还没接到上传，format 是红的

数量/大小/MIME/文件名边界、拒绝穿越和 octet-stream，缝是对的。但：

• 校验器没有接到实际上传路径；#388 也不会调用它。
• MIME 和扩展名仍可能不一致（那是 #380）。
• CI format:check 红。

请先修 format，再和 #380 rebase 成一份，然后让 #388 走同一套规则。

[tt-a1i]

Exact-head review found no confirmed P2+ within this typed, currently unused pure validator. Focused tests passed 2/2. It limits count/MIME/per-file/aggregate bytes but has no production upload caller, so it does not yet deliver attachment admission in the product. The ASCII filename policy also excludes ordinary Chinese filenames; reconcile that policy when composing the actual attachment flow. Current Node 22/24 CI fails in formatting of tests/web/attachments.test.ts, verified from the run logs. Recommendation: defer standalone merge, retain useful validation rules for the attachment integration with author credit, and clear CI before any merge. No source edits or merge performed.