feat(chat): carry image upload proofs and MIME metadata

[squarezw]

Current chat uploads retain display labels such as Image instead of the original MIME type and provide no proof that an image upload belongs to the authenticated user. This change carries a scoped upload receipt and real MIME metadata through the existing upload flow into the structured chat attachment payload, enabling the companion backend image-input feature without changing text messages.

• The authenticated presign route signs only the key returned by the storage service. Receipts bind user, key, upload content type, purpose, issuer/audience and a two-hour expiry using the existing shared JWT secret. They contain no login userId claim.
• Keep uploadFile's string return value and other upload categories compatible. History normalization strips receipts; old images must be uploaded again for vision input.
• Remove request-body/full Axios error logging so upload proofs do not enter logs. Preserve safe backend image errors through both response paths.

Validation: 746 offline frontend tests passed, including the actual presign route, current-turn MIME/proof payload and HTTP cancellation integration. Targeted type checking reports the same two pre-existing lib/auth.ts errors as the unmodified main branch; full type checking is not clean on main. The i18n scan output is identical to main; locale parity passes. No paid model calls, production changes or private-repository synchronization.

Rollout: deploy the corresponding private frontend synchronization before enabling the companion ragent-service backend feature. Older backends ignore the new optional receipt; the new backend requires it for image inputs. Public main merge alone does not deploy the private frontend.