feat(attachments): provenance payload attachments + download route

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/test_provenance_service.py

@@ -7,6 +7,7 @@ from backend.app.models import (
     ImageProvenance,
     ImageRecord,
     Post,
+    PostAttachment,
     Source,
 )
 from backend.app.services.provenance_service import ProvenanceService
@@ -153,3 +154,25 @@ async def test_for_post_returns_post_source_artist(db):
                                  "url": source.url}
     assert payload["artist"] == {"id": artist.id, "name": "Carol",
                                  "slug": "carol"}
+
+
+@pytest.mark.asyncio
+async def test_for_post_includes_attachments(db):
+    artist, source, post = await _seed_post(
+        db, artist_name="Att", slug="att", platform="patreon",
+        ext_id="55",
+    )
+    db.add(PostAttachment(
+        post_id=post.id, artist_id=artist.id, sha256="t" + "0" * 63,
+        path="/images/attachments/t00/t.zip", original_filename="t.zip",
+        ext=".zip", mime="application/zip", size_bytes=9,
+    ))
+    await db.flush()
+    svc = ProvenanceService(db)
+    payload = await svc.for_post(post.id)
+    assert len(payload["attachments"]) == 1
+    att = payload["attachments"][0]
+    assert att["original_filename"] == "t.zip"
+    assert att["download_url"].endswith(
+        f"/api/attachments/{att['id']}/download"
+    )