ac7f790303
- New §5.10 Media: presign-upload/download + upload/blob endpoints, attachment shape, governance notes (25MB + type allowlist via OPA, signed tokens, tenant fence), and a sequence diagram of the presign→upload→send→signed-download flow with the OPA gate. - SDK: uploadMedia/mediaUrl; send() attachment/mentions. - Auth §3: real OIDC (Supabase/AUTH_ISSUERS) JWKS verification alongside dev HS256. - Env: MEDIA_DIR/MEDIA_SECRET/PUBLIC_URL/SUPABASE_URL/AUTH_ISSUERS; test count 192. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>