feat: enforce attachment validation (type, size, filename, malware hook)

[DavidAkere204]

• Add attachmentValidation.ts with MIME allowlist (PDF only), 10 MB size limit, filename sanitization (path traversal, null bytes, HTML injection, length), PDF magic-byte check, and a swappable malware- scan hook for server-side use
• Wire UploadModal.tsx to validateAttachment() on both file-input change and drag-and-drop; show rejection reason in role=alert region
• Add /api/attachments/validate route that re-runs the full server-side validator (magic bytes + MIME + size + filename + malware stub) via busboy multipart parsing
• Add 65 unit/component tests covering success, failure, boundary, and ordering cases across both client and server validators

closes #875

[drips-wave]

@DavidAkere204 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits