feat: attach sanitized image and opt-in diagnostics to feedback

[kalvinnchau]

Scope

Stack 2 on #242. Attaches sanitized images and opt-in diagnostics to private kind 42000 feedback using the session-bound ordinary media uploader, matching Buzz Desktop. Text enters the deployment feedback inbox; uploaded media remains subject to ordinary deployment media-read policy, not inbox-only access. Images upload when selected, diagnostics only when explicitly opted in at send, and closing/removing/discarding does not remotely delete uploads.

Upload policy alignment

Kalvin explicitly accepted using the ordinary Blossom media upload path for feedback images and opt-in diagnostics to match block/buzz Desktop, rather than requiring new operator-only attachment storage for this parity change. Feedback text remains in the private kind 42000 inbox; attachments follow the deployment’s ordinary media-read policy and are not operator-only. The UI discloses this before image selection and warns that removing or discarding feedback does not delete uploaded blobs. Desktop source trace: block/buzz at 20131488528e35e6c50f4ccdb0490a9135c28edf, desktop/src/features/settings/hooks/useSendFeedback.ts → desktop/src-tauri/src/commands/media.rs (PUT /upload). This records the accepted access tradeoff, not proof of deployed media policy or native execution.

Implementation

• Keep feedback preparation outside relay protocol; preserve broker validation of tenant-local imeta, signed event, and session/destination/cancellation fences.
• Gate upload on a scoped writable feedback session. Default diagnostics off; no channel membership gate for this channel-less operation.
• Disclose media visibility and non-deletion before selection and at local discard confirmation.

Evidence and deferred

• Rebased on feat: add private text feedback plugin #242 head 8d1fd8c and main 6fa0e9a. At head 725fdae: typecheck, full Vitest package suite (326 files, 3,554 tests, two workers), and pre-push selected checks passed. The unbounded Vitest run timed out in an unrelated Vite-config subprocess; its isolated rerun and bounded full run passed. Node integration test run was blocked by offline Cargo cache missing bech32; do not count it as pass.
• Synthetic broker and component/session fixtures exercise bounded tags, upload affordances, diagnostics opt-in, retry and disclosure. No faithful isolated relay/media workflow, packaged-native run, Desktop native workflow, or tenant cross-read probe has run at this head. Keep draft pending these and hosted CI; prior CI results were on old heads.

No browser cases added or removed. Do not interpret green source-level tests as remote media confidentiality.