Add an attachments table and AJAX upload/management on the article
create and edit pages.
- Attachment model with article_id (0 while pending on create),
session_token ownership, and SHA-256 content-addressed stored_name
- Upload validates via the platform policy (switch/type/size) and
deduplicates on disk by content hash
- Plan-A binding: attachments uploaded before an article exists are
owned by a session token and bound to the new article on save
- Delete soft-removes the record and drops the disk file only when no
remaining rows reference it (reference counting for deduped files)
- Edit page loads existing attachments via JSON list endpoint
- Row actions: insert into body (markdown image/link), set as cover
(image only), and delete
- Download URLs use the configured default download base URL when set,
else the local /uploads path
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
