feat(messages): attach files and share appointments

- new message_attachments table + POST/GET /api/conversations/attachments
  (base64 upload, capped 10MB; authed clinic-scoped download)
- messages carry an attachments JSON column (file refs or appointment
  snapshots); realtime + REST send accept attachments and allow
  attachment-only messages; migration 0019
- composer "+" menu (Files / Appointments): file picker uploads and
  stages chips; appointment picker searches by patient and attaches a
  snapshot; both render in the thread (download chip / appointment card)
- raise express json limit to 15mb for base64 uploads

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/index.ts

@@ -53,7 +53,9 @@ app.use((req, _res, next) => {
 // named wildcard ("*splat") rather than a bare "*".
 app.all("/api/auth/*splat", toNodeHandler(auth));
 
-app.use(express.json());
+// 15mb accommodates base64-encoded message attachments (capped at 10mb of bytes
+// in the conversations route, which is ~13.3mb once base64-encoded).
+app.use(express.json({ limit: "15mb" }));
 
 app.get("/health", (_req, res) => {
   res.json({ status: "ok" });