enhancement(messaging): replace absolute upload paths with artifact IDs

[lidge-jun]

Summary

Upload and attachment flows still expose absolute file paths through API responses, prompt text, and downstream send contracts. This couples browser / Telegram / Discord / agent prompts directly to local filesystem layout.

Current Review Status

• Open after the 2026-04-18 pull audit
• /api/upload still returns { path: filePath, filename }
• buildMediaPrompt() and buildMediaPromptMany() still embed absolute paths in prompt text
• file_path remains the active outbound contract

Suggested Scope

• Introduce artifactId + metadata as the stable contract
• Keep internal artifactId -> absolute path mapping
• Migrate prompts and send APIs away from raw paths gradually

Evidence

• src/routes/messaging.ts:80
• lib/upload.ts:36-50
• src/messaging/send.ts
• src/prompt/templates/a1-system.md
• src/prompt/templates/employee.md