Shrink a photo to what the provider takes, and put it in its own bubble

Sending an image was broken in the way that is hardest to see from the
phone: a camera photo is twelve megapixels and several megabytes, the Claude
API resizes anything past 1568px on its long edge before looking at it and
refuses far larger outright, so the picture was uploaded whole over the
tunnel to be thrown away or rejected at the other end.

Shrunk on the phone, to a limit the server states. Which number it is comes
from the provider's *kind* -- `DriverKind::max_image_edge`, reported on the
session row -- because that is where a provider's requirements are known,
and a phone carrying its own copy of them would be a second place to update
when one changes. `None` where nothing cares, rather than a large number:
"no limit" and "a limit that happens to be big" are different answers and
only one of them stays true. Doing it before the upload rather than after is
the point -- the expensive part on a phone is the tunnel, not the decode --
and an image already inside the limit is uploaded byte for byte rather than
being round-tripped through JPEG for nothing.

EXIF orientation is applied while scaling. The camera writes which way up
the picture is into a tag rather than into the pixels, and re-encoding drops
it, so a portrait photo would have arrived at the model on its side with
nothing anywhere saying so.

**What is attached is now visible before it is sent**, in a row directly
above the box it will be sent from: the count on the "+" button said how
many and never which, so the only way to find out what you had picked was to
send it. It scrolls sideways rather than shrinking, and tapping one takes it
back off -- an image picked by mistake could otherwise only be dealt with by
sending it. The tile is outlined as well as filled, because most of what
gets attached here is a screenshot of a dark app and a cropped one is
near-black: without an edge the only thing on screen saying an image was
attached was the cross drawn on top of nothing.

**And the picture is inside the bubble that sent it.** Attachments used to
be their own `Image` events emitted just before the message, which drew
somebody's screenshot as a row floating above the bubble and left the phone
deciding from adjacency alone which message an image belonged to -- a thing
the sender knew and could simply say. `UserMessage`, `MessageQueued` and
`MessageTaken` carry the refs now, so a waiting message keeps its picture
for as long as the turn runs, and a replay puts it back in the same place.

Verified on a real claude-cli session rather than an echo one, since the
limit only exists for that kind: a 3000x4000 image arrived as 1176x1568
JPEG -- long edge exactly the limit, aspect ratio intact -- and haiku
answered "AI Sessions displays idle Photo", which is what the picture was.
No error, and the transcript records the message with `images` on it.

server/src/config.rs

@@ -135,6 +135,32 @@ pub enum DriverKind {
 }
 
 impl DriverKind {
+    /// The longest edge, in pixels, an image should have when it reaches
+    /// this kind of session -- `None` where nothing here has a limit worth
+    /// enforcing.
+    ///
+    /// Reported to the phone rather than applied here, so the bytes are made
+    /// small before they cross the tunnel instead of after: a modern phone
+    /// photo is several megabytes and twelve megapixels, and every one of
+    /// those bytes was being uploaded over WireGuard only to be rejected at
+    /// the other end. What decides the number is the provider, which is why
+    /// it lives beside the kind rather than in the app -- a phone that knew
+    /// each provider's limits would be a second place to update when one
+    /// changes.
+    ///
+    /// 1568 for the Claude CLI because that is the longest edge the API
+    /// itself resizes to; anything larger is charged the same and spends the
+    /// upload for nothing, and far larger is refused outright, which is what
+    /// "sending an image is broken" turned out to be. The others take images
+    /// through no path that cares, so they get no limit rather than a made-up
+    /// one.
+    pub fn max_image_edge(self) -> Option<u32> {
+        match self {
+            DriverKind::ClaudeCli => Some(1568),
+            DriverKind::Echo | DriverKind::LlamaCpp => None,
+        }
+    }
+
     /// Whether the conversation exists outside this app, so that deleting
     /// the session here does not end it.
     ///