feat(web): add attachment staging lifecycle

[testikun]

Problem

The attachment work tracked by #344 has admission metadata validation in review, but no host-owned lifecycle for canonical temporary bytes. Browser filenames must not become filesystem authority, and staged bytes need exact command ownership and deterministic cleanup.

Value

Future composer and multimodal prompt work gets a fail-closed storage primitive with bounded resource use, single-consume semantics, and explicit stale or settled receipts.

Approach

Add a private attachment staging store that:

• writes payloads under server-generated file identities in a private host directory;
• binds every batch to the exact canonical workspace, Session id, and command id;
• serializes stage, consume, discard, and disposal mutations;
• enforces injected count, per-file, per-command, store-wide byte, and settled-receipt limits;
• rejects changed files and symlinks before reading;
• removes staged artifacts on consume, discard, failed integrity checks, and store disposal.

This is a focused backend slice and intentionally does not duplicate #365/#380 metadata admission validation or #384 UI work.

Validation

• bun run check
• bun run test: 1245 passed, 0 failed, 1 skipped; Vitest 30 passed
• focused attachment staging tests: 4 passed
• git diff --check

Impact

• User-visible behavior: none until the composer integration lands.
• Model-visible context/tools: none.
• Runtime/lifecycle: adds an opt-in host-owned temporary byte lifecycle; no current request path changes.
• Persisted config/data: none; artifacts are private and temporary.
• Compatibility/risk: additive module only. Limits are injected so the final upload path can use the authoritative admission policy without a second default.

Related to #344.

[testikun]

CI context: both Linux Node jobs reach the pre-existing packed standalone Web CLI smoke, install the tarball, and then the server exits before announcing its origin (kill: No such process). Windows and the other checks pass. This matches the independently reproduced fresh-install peer-dependency failure tracked in #328, where npm selects Pi 0.85.0 and @earendil-works/pi-server cannot be resolved. Evidence: #328 (comment)

This PR does not change package metadata, CLI startup, or peer-dependency resolution. Its local check, focused tests, full Node suite, and Vitest suite pass as recorded in the PR body.