Messaging: attachments in the composer

The sendMessage API already accepts and authz-checks attachmentIds — verified 2026-07-04 — but neither composer (client or staff) ever sends any, so attachments are dead-ended at the UI.

Scope: wire the existing upload pipeline (presign → PUT → finalize → scan) into both composers, attachment chips on messages, download via the scanned/served path. Wave 0 content work per the market-audit decision #5 — runs parallel to launch hardening. Related messaging depth (reopen closed threads, filters/search) is tracked as its own card.