feat(upload): signed URLs for CLI + eager load attachments on comments

- Add CloudFrontSigner.SignedURL() for generating per-resource signed URLs
- Attachment responses include download_url (5-min signed URL for CLI)
- Eager load attachments on comments and timeline (same pattern as reactions)
- Add ListAttachmentsByCommentIDs query for batch loading
- Update Comment and TimelineEntry types with attachments field

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/pkg/db/queries/attachment.sql

@@ -17,5 +17,10 @@ ORDER BY created_at ASC;
 SELECT * FROM attachment
 WHERE id = $1 AND workspace_id = $2;
 
+-- name: ListAttachmentsByCommentIDs :many
+SELECT * FROM attachment
+WHERE comment_id = ANY($1::uuid[])
+ORDER BY created_at ASC;
+
 -- name: DeleteAttachment :exec
 DELETE FROM attachment WHERE id = $1 AND workspace_id = $2;