attachments sync: attach offline, upload when linked, removals stick (#5168)

Desktop could not create an attachment at all, and a removed attachment or
dismissed preview came back on the next pull. Now:

- core: add_attachment keeps the bytes in the blob store and queues the row
  (schema v10: attachments.uploaded / upload_error). Push uploads it once its
  note has landed. A refusal that retrying won't fix (too large, id clash, hash
  mismatch) is recorded on the file and not re-sent every cycle; the editor
  shows it.
- core: removing a synced attachment or dismissing a preview leaves a tombstone
  in pending_deletes; push sends it as an `attachment`/`preview` delete, and a
  pull while it waits doesn't put the row back. A pull also keeps files still
  waiting to upload instead of replacing them wholesale.
- server: PUT /api/sync/attachments/<id> (raw body, sha256-checked, idempotent,
  size-capped) and child deletes in push, which apply regardless of LWW and
  answer noop for rows the caller can't see. One store_attachment helper for
  the upload route, the importer and sync. Protocol 5, feature attachment_sync;
  the client sends neither to a server without it.
- server: migration 0031 makes a link preview's insert/delete bump its note, so
  background-fetched previews and web dismissals reach linked devices.
- desktop: Attach and paste-image work offline (raw-bytes IPC command).
- SVG is served as a download by the desktop blob scheme too (as #1981 did for
  the web), and drawn as a file chip on both.
- autosync: drop the catch_unwind; release builds abort on panic, so it only
  ever worked in debug builds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

core/src/sync/compat.rs

@@ -23,7 +23,9 @@ use std::sync::OnceLock;
 ///
 /// v4 (M315): `color` left the note. NOT a floor raise on either side — see the note
 /// on [`MIN_SERVER_PROTOCOL_VERSION`].
-pub const CLIENT_PROTOCOL_VERSION: u32 = 4;
+/// v5 (#5168): files attached here upload, and removed attachments and previews are
+/// pushed. Additive: both go only to a server advertising `attachment_sync`.
+pub const CLIENT_PROTOCOL_VERSION: u32 = 5;
 
 /// The oldest server protocol this client can drive — the symmetric half of the
 /// server's `min_client_protocol_version`.
@@ -47,7 +49,8 @@ pub const REQUIRED_FEATURES: &[&str] = &["notes", "labels"];
 /// Capabilities whose absence costs a feature but not the link. Listing these
 /// explicitly (rather than diffing against whatever the server happens to send) is
 /// what lets the UI name exactly what the user will be missing.
-pub const OPTIONAL_FEATURES: &[&str] = &["attachments", "tombstones", "revisions"];
+pub const OPTIONAL_FEATURES: &[&str] =
+    &["attachments", "tombstones", "revisions", "attachment_sync"];
 
 /// The handshake fields of `GET /api/config`.
 ///
@@ -75,7 +78,7 @@ pub struct ServerInfo {
 }
 
 impl ServerInfo {
-    fn has_feature(&self, name: &str) -> bool {
+    pub fn has_feature(&self, name: &str) -> bool {
         self.sync_features.iter().any(|f| f.as_str() == name)
     }