Serve Attachment

Stream the bytes of an attachment back to a participant.

variant is either "full" (original, EXIF-stripped) or "thumb" (320×320-max WebP). Anything else 404s. The viewer must be the uploader, sender, or recipient — enforced by _attachment_for_viewer.

The bytes come from the private dm_attachments bucket, which has no public URL by construction. This route IS the access control: it checks participation, then streams. Nothing else can hand a client these bytes.

We stream rather than buffer because an attachment is up to 10 MB and get() would hold all of it per concurrent reader. Note that StreamingResponse does not serve HTTP Range requests, which FileResponse did — irrelevant for inline chat images, and the price of not requiring the object to be a local file.