feat: attach material files over MCP as base64

- storeMaterialFile: the one attach.Store call of the management API,
  shared by the multipart route and the new inline route
- POST /api/v1/bm/materials/{id}/files/inline: JSON {name, mime?,
  content_base64}, at most 3000000 bytes decoded, body.limit 4300000
- bm_manage_attach_material_file and bm_manage_detach_material_file,
  both warning that material files are public to anyone with the link

controllers/api/manage.go

@@ -476,6 +476,12 @@ func (h *Handlers) ManagedMaterial(w http.ResponseWriter, r *http.Request) {
 // shows it, or 404 when there is none. Under MCP a GET carries the body only
 // with include_body, and any other method's answer never does.
 func (h *Handlers) writeMaterialDetail(w http.ResponseWriter, r *http.Request, db *gorm.DB, id uint, status int) {
+	h.writeMaterialDetailWith(w, r, db, id, status, nil)
+}
+
+// writeMaterialDetailWith is writeMaterialDetail with extra top-level keys
+// beside data (the file warning of the inline upload).
+func (h *Handlers) writeMaterialDetailWith(w http.ResponseWriter, r *http.Request, db *gorm.DB, id uint, status int, extra map[string]any) {
 	var m models.Material
 	res := preloadMaterial(db).Where("jz_bm_materials.id = ?", id).Limit(1).Find(&m)
 	if res.Error != nil {
@@ -499,7 +505,11 @@ func (h *Handlers) writeMaterialDetail(w http.ResponseWriter, r *http.Request, d
 		}
 		out.Files = append(out.Files, fileJSON{ID: f.ID, URL: f.URL(), Name: f.FileName, Size: f.FileSize, Mime: f.ContentType})
 	}
-	wire.WriteJSON(w, status, map[string]any{"data": managedMaterialDetailView(out, viaMCP(r), r.Method == http.MethodGet && includeBody(r))})
+	answer := map[string]any{"data": managedMaterialDetailView(out, viaMCP(r), r.Method == http.MethodGet && includeBody(r))}
+	for k, v := range extra {
+		answer[k] = v
+	}
+	wire.WriteJSON(w, status, answer)
 }
 
 // DeleteMaterial answers DELETE /materials/{id}.