attachments sync: attach offline, upload when linked, removals stick (#5168)

Desktop could not create an attachment at all, and a removed attachment or
dismissed preview came back on the next pull. Now:

- core: add_attachment keeps the bytes in the blob store and queues the row
  (schema v10: attachments.uploaded / upload_error). Push uploads it once its
  note has landed. A refusal that retrying won't fix (too large, id clash, hash
  mismatch) is recorded on the file and not re-sent every cycle; the editor
  shows it.
- core: removing a synced attachment or dismissing a preview leaves a tombstone
  in pending_deletes; push sends it as an `attachment`/`preview` delete, and a
  pull while it waits doesn't put the row back. A pull also keeps files still
  waiting to upload instead of replacing them wholesale.
- server: PUT /api/sync/attachments/<id> (raw body, sha256-checked, idempotent,
  size-capped) and child deletes in push, which apply regardless of LWW and
  answer noop for rows the caller can't see. One store_attachment helper for
  the upload route, the importer and sync. Protocol 5, feature attachment_sync;
  the client sends neither to a server without it.
- server: migration 0031 makes a link preview's insert/delete bump its note, so
  background-fetched previews and web dismissals reach linked devices.
- desktop: Attach and paste-image work offline (raw-bytes IPC command).
- SVG is served as a download by the desktop blob scheme too (as #1981 did for
  the web), and drawn as a file chip on both.
- autosync: drop the catch_unwind; release builds abort on panic, so it only
  ever worked in debug builds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/views/SyncView.vue

@@ -233,6 +233,8 @@ function showOutcome(outcome: SyncOutcome) {
   const blobs = outcome.pull.blobs_downloaded;
   const parts: string[] = [];
   if (sent > 0) parts.push(`sent ${sent}`);
+  const up = outcome.push.uploaded;
+  if (up > 0) parts.push(`uploaded ${up} file${up === 1 ? "" : "s"}`);
   if (received > 0) parts.push(`received ${received}`);
   if (blobs > 0) parts.push(`${blobs} attachment${blobs === 1 ? "" : "s"}`);
   lastResult.value = parts.length ? `Synced — ${parts.join(", ")}.` : "Already up to date.";
@@ -244,10 +246,12 @@ function showOutcome(outcome: SyncOutcome) {
   // Rejections are the server refusing a specific change — surfaced, never
   // swallowed, because only the person can resolve them. The background cycle does
   // not resend them on its own (autosync.rs), so this stays until they're fixed.
-  syncError.value =
-    outcome.push.rejected > 0
-      ? `${outcome.push.rejected} change(s) the server wouldn't accept: ${outcome.push.errors.join("; ")}`
-      : "";
+  // A file refused for good is listed once, here, and not retried; the editor says so
+  // on the file itself from then on.
+  const problems: string[] = [];
+  if (outcome.push.rejected > 0) problems.push(`${outcome.push.rejected} change(s) the server wouldn't accept`);
+  if (outcome.push.upload_failed > 0) problems.push(`${outcome.push.upload_failed} file(s) didn't upload`);
+  syncError.value = problems.length ? `${problems.join(" and ")}: ${outcome.push.errors.join("; ")}` : "";
 }
 
 async function syncNow() {