Add attachment upload: drop, paste, picker with progress

[unforced]

Summary

• Drag-drop, paste-from-clipboard, and a picker button upload files to the vault storage endpoint; markdown (![alt](url) for images, [filename](url) otherwise) is inserted at the cursor on success
• /notes/:id/edit links attachments immediately; /new stages uploads and links them after the note is created (no orphan blobs if the draft is cancelled)
• XHR-backed uploads so we can show per-file progress + cancel mid-flight; AbortController wired through useAttachmentUploader
• Inline images in preview go through VaultImage, which blob-fetches past the auth-gated storage endpoint
• Client-side size cap 100 MB + extension allowlist (wav/mp3/m4a/ogg/webm/png/jpg/jpeg/gif/webp) — rejected with a toast before any network call; PDF + mp4 tracked in parachute-vault#127

Sequencing

Attachment sidebar is read-only this PR. Remove button is sequenced to PR #8.5, after the vault-side DELETE /api/notes/:id/attachments/:attId endpoint lands.

Test plan

• bun run lint — clean
• bun run typecheck — clean
• bun run test — 100/100 pass (14 files), including:
  • client.test.ts: uploadStorageFile multipart + Bearer + progress; 401 → VaultAuthError; 413 → VaultUploadError; abort → AbortError; linkAttachment POST + 401
  • NoteNew.test.tsx: drop → upload → insert + stage; paste-image; oversized-file rejected; happy-path drop → stage → create → link
  • NoteEditor.test.tsx: drop → upload → insert + immediate link; oversized-file rejected
• bun run build — green (1.18 MB gzip 381 KB; bundle-split follow-up already filed)
• Smoke in dev server against live vault (deferred — needs running vault, not available in this environment)

🤖 Generated with Claude Code