feat(mobile): attach images from the phone's photo library

[Tryanks]

What changes

Mobile photo attachments. A + button at the left of the phone composer row opens a bottom sheet with Photo library, which calls the platform's own picker: PHPickerViewController on iOS, MediaStore.ACTION_PICK_IMAGES on Android 13+ and ACTION_OPEN_DOCUMENT below. Neither needs a permission. The picker returns bytes through a new ClientHost::pick_images (crates/client/src/host.rs), wired in NativeClientHost with the same request/callback pattern as QR scanning. Desktops keep paste and drop; the button only renders when the host reports a picker.

Fitting on the device (fit_for_upload, crates/ui/src/composer/components/images.rs): images longer than 2048 px on either side are resized, non-wire formats become PNG, JPEG stays JPEG, GIF is never re-encoded. Bytes that already qualify pass through untouched. iOS delivers HEIC as JPEG via .compatible representation.

Link-aware transfer policy (crates/ui/src/attachments.rs, transfer_verdict):

Link	Behaviour
Local / LAN	only the existing 10 MiB / 8 images limits
Tunnel (direct across the internet)	above the device limit → confirm dialog
Relay, or unknown	above the device limit → refused with a message

The limit is a device preference (ClientPreferences::remote_attachment_limit_mib, default 2 MiB) with a row in Settings → General.

Fixes found on the way:

• crates/client/src/outgoing.rs capped one line at 8 MiB while the transport allows 16 MiB; a 10 MiB attachment encodes to ~13 MiB, so images over ~6 MiB failed with queue_full over any remote connection. The cap now has one owner, tcode_protocol::MAX_LINE_BYTES, used by both the traverse wire and the client queue.
• The host never checked SaveAttachment: it now rejects a dir outside its attachments root or containing .., an extension that is not plain alphanumeric (the generated file name embeds it), and bytes over the per-image limit (crates/runtime/src/pipe.rs, AppState::accepts_attachment).

Abstractions

• TransferLink/TransferVerdict hide the path-kind → policy mapping; WorkspaceStore::attachment_link is the one place ConnectionState is read for it.
• PreparedImage replaces a tuple; owns_image_load replaces a three-way condition duplicated at two completion points.
• is_safe_extension and attachments_root live in core / services next to the limits and layout they belong to.
• transcode_image_to_png is folded into fit_for_upload (its only caller).

Tests

• pipe_p4b_tests: extends the SaveAttachment round trip with the four rejected shapes (outside root, .., traversal in ext, oversized).
• attachments::tests: the verdict table above.
• images::tests: fitting bounds the long edge, keeps qualifying bytes, converts BMP, leaves GIF alone, rejects non-images.
• core::attachments: extension admission.
• Native host preference round-trip extended with the new field; locale parity covers the new strings in en and zh-CN.

Checks run

• cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings, cargo nextest run --workspace --locked (950 passed), cargo-machete: clean.
• cargo check -p tcode-ios --target aarch64-apple-ios-sim, cargo ndk -t arm64-v8a check -p tcode-android, cargo check -p tcode-web --target wasm32-unknown-unknown, all with -D warnings: clean.
• Swift: swiftc -typecheck against the iOS 27 simulator SDK; Java: gradlew :app:compileReleaseJavaWithJavac: clean.

Not verified

• No on-device run. The picker flows (PHPicker delegate, Android content URI reads, the + layout at phone width) are established only by the type checks above; the + does not appear in --example phone because that shell has no picker-capable host.
• The browser client is unchanged and still limited by its 64 KiB WebSocket frame; it never attached images before either.