fix(files): parse attachments server-side and bound previews

[Luhaozhu]

Summary / 概述

• Make persisted file_id the only attachment payload sent by chat and plan requests, then parse and cache file content on the backend when the model first needs it.
• Bound automatic attachment previews and expose the backend preview budget so the context gauge no longer estimates raw binary bytes as prompt tokens.
• Add safe browser preview limits, streamed reads, an XLSX Web Worker, populated-cell/range guards, and download fallbacks for oversized files.
• Update the matching English and Chinese API, frontend architecture, canvas, and My Space documentation.

Validation:

• PYTHONPATH=src/backend pytest src/backend/tests/llm/test_file_context_preview.py src/backend/tests/services/test_artifact_reader.py src/backend/tests/services/test_artifact_summary.py src/backend/tests/api/test_cross_turn_file_access.py -q — 53 passed.
• npm run build — passed, including i18n validation and the production TypeScript/Vite build.
• Targeted ESLint passed for the spreadsheet worker, file preview components, context accounting, parser, and preview safety utilities. CanvasPanel.tsx still reports five pre-existing React hook/ref violations on unchanged lines.
• The upstream CE generator passed brand, license, import/OpenAPI/ORM, and CE release regression gates.
• git diff --check passed. This repository has no root npm run preflight script, so the relevant backend and frontend checks above were used.

Related issue / 关联 Issue

N/A.

Type of change / 变更类型

• 📖 Documentation (document/**, README*.md)
• 🧩 Example / sample (examples/**)
• 🔧 Repo meta (CI, templates, .github/**)
• Other (please describe / 请说明): Maintainer sync of an upstream attachment-processing and preview-safety fix.

Checklist / 检查项

• My change only touches non-generated paths (docs / examples / repo meta). 仅改动非生成路径。
• Links and code snippets were verified. 链接与代码片段已验证。
• For bilingual docs, I updated both document/en/** and document/zh-CN/** where applicable. 双语文档已同步更新（如适用）。
• I read CONTRIBUTING.md. 我已阅读贡献指南。