attachments sync: attach offline, upload when linked, removals stick (#5168)

Desktop could not create an attachment at all, and a removed attachment or
dismissed preview came back on the next pull. Now:

- core: add_attachment keeps the bytes in the blob store and queues the row
  (schema v10: attachments.uploaded / upload_error). Push uploads it once its
  note has landed. A refusal that retrying won't fix (too large, id clash, hash
  mismatch) is recorded on the file and not re-sent every cycle; the editor
  shows it.
- core: removing a synced attachment or dismissing a preview leaves a tombstone
  in pending_deletes; push sends it as an `attachment`/`preview` delete, and a
  pull while it waits doesn't put the row back. A pull also keeps files still
  waiting to upload instead of replacing them wholesale.
- server: PUT /api/sync/attachments/<id> (raw body, sha256-checked, idempotent,
  size-capped) and child deletes in push, which apply regardless of LWW and
  answer noop for rows the caller can't see. One store_attachment helper for
  the upload route, the importer and sync. Protocol 5, feature attachment_sync;
  the client sends neither to a server without it.
- server: migration 0031 makes a link preview's insert/delete bump its note, so
  background-fetched previews and web dismissals reach linked devices.
- desktop: Attach and paste-image work offline (raw-bytes IPC command).
- SVG is served as a download by the desktop blob scheme too (as #1981 did for
  the web), and drawn as a file chip on both.
- autosync: drop the catch_unwind; release builds abort on panic, so it only
  ever worked in debug builds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

core/src/sync/engine.rs

@@ -38,7 +38,17 @@ pub async fn run_cycle(
     base_url: &str,
     token: &str,
 ) -> Result<SyncOutcome, String> {
-    let push = push::run(db, base_url, token).await?;
+    // What this server can do, asked before anything is sent: files attached here,
+    // and removed attachments and previews, go only to a server advertising
+    // `attachment_sync`. An older one keeps them queued on this device until it is
+    // updated, rather than refusing each one on every cycle. Best-effort — an
+    // unanswered probe reads as "not advertised", and the cycle carries on.
+    let server = super::client::probe(base_url).await.ok().map(|p| p.server);
+    let attachment_sync = server
+        .as_ref()
+        .is_some_and(|s| s.has_feature("attachment_sync"));
+
+    let push = push::run(db, blobs, base_url, token, attachment_sync).await?;
     let pull = pull::run(db, blobs, base_url, token).await?;
 
     if pull.clobbered_dirty > 0 {
@@ -51,15 +61,11 @@ pub async fn run_cycle(
         );
     }
 
-    // While we're already talking to this server, re-read what it says about itself.
-    // Today that's the trash-retention window the Trash view counts down against, and
-    // it can change under us whenever an admin edits the setting. Best-effort on
-    // purpose: a config blip must not fail a cycle whose actual work already
-    // succeeded, and the stored value simply stays as it was.
-    let retention = super::client::probe(base_url)
-        .await
-        .ok()
-        .and_then(|p| p.server.trash_retention_days);
+    // The same answer carries the trash-retention window the Trash view counts down
+    // against, which can change whenever an admin edits the setting. Best-effort on
+    // purpose: a config blip must not fail a cycle whose actual work succeeded, and
+    // the stored value simply stays as it was.
+    let retention = server.and_then(|s| s.trash_retention_days);
 
     let status = {
         let conn = db.0.lock().map_err(|e| e.to_string())?;