[cloud-storage] blobs: attachments, artifact bytes, generated media and downloads onto BlobStore #7425

Parent: #7419

Context

Nothing in the core uses BlobStore yet. Large user data sits on pod-local disk:

• uploads: agent/attachments/mod.rs:288, legacy.rs:143, provider_source.rs:232, under <action_dir>/uploads/<thread>/…;
• AttachmentStash (ATTACHMENTS_DIR OnceLock);
• artifact content: agent/artifacts/files.rs:141, under ~/OpenHuman/projects/Files;
• generated media: media/generation/artifact_tool.rs:203;
• documents and slides: tools/impl/{document,presentation}/mod.rs;
• downloads: integrations/file_storage/tools/download.rs:84.

ArtifactMeta.path (agent/artifacts/types.rs:87) is an absolute local path that is returned to clients. The storage-bypass allowlist says "the port has no blob store", which is stale.

Scope

• Artifact bytes → BlobStore, keyed artifacts/<id>/<name>. ArtifactMeta holds a blob key, not a path. The desktop keeps an optional "export to Files folder".
• Attachments → BlobStore, keyed uploads/<thread>/<id>; rehydration reads blobs. Delete legacy.rs absolute-path rehydration after a migration window.
• provider_cache.rs derived readouts → blob cache, regenerated on a miss.
• Generated media, docs, slides and downloads write to blobs, and to the action dir only when the agent asked for a file in its working directory.
• RPC: ai.get_artifact returns bytes or a presigned URL (depends on the S3 driver sub-issue). Add an upload/download route so large attachments don't travel base64 inside the 43 MiB /rpc body.
• Frontend: artifact viewer and attachment chips use the new fields.
• Update the allowlist comment in scripts/ci/check-storage-bypass.mjs and the baseline.

Acceptance criteria

• With a URL set, no writes under uploads/ or projects/Files (test).
• An artifact created on pod A downloads from pod B.
• Existing desktop artifacts stay readable after upgrade (migration regression test).

Verification

Run the affected tests against the memory, sqlite: and mongodb:// drivers (scripts/test-rust-with-mock.sh / pnpm test:rust), plus node scripts/ci/check-storage-bypass.mjs (the baseline must shrink), node scripts/ci/check-feature-forwarding.mjs and pnpm rust:layout. The upstream submodule PR lands first, then the gitlink bump. Existing desktop data needs an import path with a regression test.