src/lib/chatAttachments.ts and the routes below.
An attachment records its identity, filename, MIME type, storage URI, lifecycle state, and ownership scope. A content job may reference
mediaAttachmentId, but ingestion proceeds only after completion and a valid source-rights authorization defined by src/lib/sourceRights.ts.
Uploaded bytes belong in the configured asset store. The browser does not mint workflow authority, and a filename or MIME declaration is not proof of rights or content integrity.