feat(attachments): provenance payload attachments + download route

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/test_api_attachments.py

@@ -0,0 +1,47 @@
+import pytest
+
+from backend.app import create_app
+from backend.app.models import Artist, PostAttachment
+
+pytestmark = pytest.mark.integration
+
+
+@pytest.fixture
+async def app():
+    return create_app()
+
+
+@pytest.fixture
+async def client(app):
+    async with app.test_client() as c:
+        yield c
+
+
+@pytest.mark.asyncio
+async def test_download_streams_with_disposition(client, db, tmp_path):
+    blob = tmp_path / "pack.zip"
+    blob.write_bytes(b"PK\x03\x04binarypayload")
+    a = Artist(name="Q", slug="q")
+    db.add(a)
+    await db.flush()
+    att = PostAttachment(
+        post_id=None, artist_id=a.id, sha256="q" + "0" * 63,
+        path=str(blob), original_filename="pack.zip", ext=".zip",
+        mime="application/zip", size_bytes=blob.stat().st_size,
+    )
+    db.add(att)
+    await db.flush()
+    await db.commit()
+
+    resp = await client.get(f"/api/attachments/{att.id}/download")
+    assert resp.status_code == 200
+    disp = resp.headers.get("Content-Disposition", "")
+    assert "attachment" in disp
+    assert "pack.zip" in disp
+    assert (await resp.get_data()) == b"PK\x03\x04binarypayload"
+
+
+@pytest.mark.asyncio
+async def test_download_404(client):
+    resp = await client.get("/api/attachments/999999/download")
+    assert resp.status_code == 404