fix(web): bound asynchronous attachment intake

[oleksoleksoleks]

Summary

• retain PR fix(web): materialize Android picker images on selection #122's Android picker materialization
• serialize materialization and admission so concurrent batches cannot bypass global staged-memory limits
• invalidate queued intake when permanent session deletion advances its lifetime generation

Supersedes #122.

Screenshots

No visual change.

Testing

• pnpm --filter @t4-code/web typecheck
• pnpm --filter @t4-code/web test (86 files, 1219 tests passed)

Risk

• Later picker batches wait for earlier materialization instead of reading concurrently.

Notes

• Rebased on current main.

AI Review Report

• Resolves session resurrection and concurrent Android WebView memory-bound findings.

Security Audit

• Prevents stale async work from recreating deleted session state.

[oleksoleksoleks]

Closing: #122 merged with a stronger reservation/token implementation that already addresses both requested lifecycle and concurrent-memory blockers. This replacement is now redundant.