feat(12-01): record multipart uploads and match Winter upload URLs

- attach.PublicURL and (*File).URL build Winter File::getPath() URLs; the
  thumbnailer decodes webp via golang.org/x/image v0.46.0 and checks the
  image size from the header before decoding
- tide requests carry multipart parts (files beside the fixture pinned by
  sha256) encoded with the fixed MultipartBoundary, so PHP and Go receive
  byte-identical bodies
- tide masks the random partition, disk name and file id of url/thumb_url
  upload URLs while still diffing prefix, size, mode and extension, and
  NormalizePublications masks Carbon dates in the published album

modules/tide/centrifugo_golden.go

@@ -164,6 +164,9 @@ var channelIDRe = regexp.MustCompile(`^((?:[a-z][a-z0-9_.-]*:)+)([0-9]+)$`)
 //     when they have the ISO 8601 offset shape;
 //   - $.data.payload.actor becomes "{{actor}}" when it is an object with
 //     exactly user_id and name;
+//   - a *_at value anywhere under $.data.payload.album becomes
+//     "{{datetime}}" when it has Carbon's +00:00 shape; any other shape is
+//     left as it is, so a format change shows up as a diff;
 //   - a number or string under an id, *_id or *_ids key that equals an id:*
 //     variable of store becomes that {{id:name}} placeholder (bare for a
 //     number, quoted for a string), and so does the numeric last segment of
@@ -304,6 +307,9 @@ func (n *normalizer) walk(path, key string, v *onode) *onode {
 		}
 		return v
 	case kindString:
+		if strings.HasPrefix(path, "$.data.payload.album.") && strings.HasSuffix(key, "_at") && carbonOffsetRe.MatchString(v.str) {
+			return &onode{kind: kindString, str: "{{datetime}}"}
+		}
 		if key != "" && isIDKey(key) {
 			if name, ok := n.lookup(v.str); ok {
 				return &onode{kind: kindString, str: "{{" + name + "}}"}