Upload a file from the web composer (the paperclip button).

Accepts JSON {filename, content_base64, content_type?} (base64 keeps the upload on the same JSON path as the rest of the API — no multipart dependency). Stores the blob and creates an attachment row owned by the signed-in handle; message_id stays NULL until the message is sent, which binds it via bind_owned_attachments_to_message. Same 25MB cap as the attach verb. Returns the new attachment_id + metadata.