attachments sync: attach offline, upload when linked, removals stick (#5168)

Desktop could not create an attachment at all, and a removed attachment or
dismissed preview came back on the next pull. Now:

- core: add_attachment keeps the bytes in the blob store and queues the row
  (schema v10: attachments.uploaded / upload_error). Push uploads it once its
  note has landed. A refusal that retrying won't fix (too large, id clash, hash
  mismatch) is recorded on the file and not re-sent every cycle; the editor
  shows it.
- core: removing a synced attachment or dismissing a preview leaves a tombstone
  in pending_deletes; push sends it as an `attachment`/`preview` delete, and a
  pull while it waits doesn't put the row back. A pull also keeps files still
  waiting to upload instead of replacing them wholesale.
- server: PUT /api/sync/attachments/<id> (raw body, sha256-checked, idempotent,
  size-capped) and child deletes in push, which apply regardless of LWW and
  answer noop for rows the caller can't see. One store_attachment helper for
  the upload route, the importer and sync. Protocol 5, feature attachment_sync;
  the client sends neither to a server without it.
- server: migration 0031 makes a link preview's insert/delete bump its note, so
  background-fetched previews and web dismissals reach linked devices.
- desktop: Attach and paste-image work offline (raw-bytes IPC command).
- SVG is served as a download by the desktop blob scheme too (as #1981 did for
  the web), and drawn as a file chip on both.
- autosync: drop the catch_unwind; release builds abort on panic, so it only
  ever worked in debug builds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/desktop/bridge.ts

@@ -4,7 +4,13 @@
 // @tauri-apps/api dependency and the web bundle is unaffected.
 
 interface TauriGlobal {
-  core: { invoke: <T>(cmd: string, args?: Record<string, unknown>) => Promise<T> };
+  core: {
+    invoke: <T>(
+      cmd: string,
+      args?: Record<string, unknown> | Uint8Array,
+      options?: { headers?: Record<string, string> },
+    ) => Promise<T>;
+  };
   // Also from `withGlobalTauri`. Needed because quick capture puts the app in TWO
   // windows, each with its own Pinia stores — a note saved in one is invisible to
   // the other until something says so, and an event is the only channel between
@@ -31,10 +37,16 @@ export function isDesktop(): boolean {
   return typeof window !== "undefined" && !!window.__TAURI__;
 }
 
-export function invoke<T>(cmd: string, args?: Record<string, unknown>): Promise<T> {
+/** Call a desktop command. `args` is either named arguments or, for a command that
+ *  takes a file, its raw bytes — with anything else it needs in `options.headers`. */
+export function invoke<T>(
+  cmd: string,
+  args?: Record<string, unknown> | Uint8Array,
+  options?: { headers?: Record<string, string> },
+): Promise<T> {
   const tauri = window.__TAURI__;
   if (!tauri) return Promise.reject(new Error("Not running in the desktop app."));
-  return tauri.core.invoke<T>(cmd, args).catch((err: unknown) => {
+  return tauri.core.invoke<T>(cmd, args, options).catch((err: unknown) => {
     // Every failed command names itself in the log — so a broken "basic function"
     // in some environment is diagnosable. Skip log_event to avoid recursion.
     if (cmd !== "log_event") logEvent("error", `invoke '${cmd}' failed: ${String(err)}`);
@@ -111,6 +123,10 @@ export interface PushSummary {
   noop: number;
   rejected: number;
   errors: string[];
+  /** Files attached on this device that reached the server this cycle. */
+  uploaded: number;
+  /** Files that didn't; their reasons are in `errors`. */
+  upload_failed: number;
 }
 
 export interface PullSummary {