feat(attachments): provenance payload attachments + download route

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/api/__init__.py

@@ -17,6 +17,7 @@ def all_blueprints() -> list[Blueprint]:
     from .aliases import aliases_bp
     from .allowlist import allowlist_bp
     from .artist import artist_bp
+    from .attachments import attachments_bp
     from .gallery import gallery_bp
     from .import_admin import import_admin_bp
     from .ml_admin import ml_admin_bp
@@ -27,6 +28,7 @@ def all_blueprints() -> list[Blueprint]:
     from .tags import tags_bp
     return [
         api_bp,
+        attachments_bp,
         gallery_bp,
         provenance_bp,
         tags_bp,

backend/app/api/attachments.py

@@ -0,0 +1,27 @@
+"""Attachment download: streams a preserved non-art post file."""
+
+from quart import Blueprint, jsonify, send_file
+
+from ..extensions import get_session
+from ..models import PostAttachment
+
+attachments_bp = Blueprint(
+    "attachments", __name__, url_prefix="/api/attachments"
+)
+
+
+@attachments_bp.route("/<int:attachment_id>/download", methods=["GET"])
+async def download(attachment_id: int):
+    async with get_session() as session:
+        att = await session.get(PostAttachment, attachment_id)
+        if att is None:
+            return jsonify({"error": "not found"}), 404
+        path = att.path
+        filename = att.original_filename
+        mimetype = att.mime or "application/octet-stream"
+    return await send_file(
+        path,
+        mimetype=mimetype,
+        as_attachment=True,
+        attachment_filename=filename,
+    )