Create support attachment upload

Reserve an image or screen recording upload owned by the caller. clientAttachmentId is a UUID; retry an unexpired pending reservation using identical metadata. Images may be at most 10 MiB and screen recordings 100 MiB. fileName is a display name without path separators or control characters. PUT the exact bytes to upload.url using upload.method and upload.mediaType as Content-Type. Do not forward the API bearer token to that signed storage URL. Then finalize the attachment before including its ID in a message. The upload URL expires at upload.expiresAt. Requires support.write and a user token. Organization API keys cannot call this operation. Uses customer permissions, with no operator or staff bypass. New mutations require rollout-agent-access-writes and allow-public-agent-writes to be enabled. Pausing writes leaves history and downloads available. Known IDs resolve their own organization; organizationId can require a specific tenant. Creation defaults to the saved organization.