feat(chat): attach pasted images, up to four per message

[hydall]

A message can now carry up to four images instead of one, and they can come
from the clipboard rather than only from the file picker. The bubble lays
several of them out as a grid rather than stacking one picture under another.

Getting an image in

• Added ClipboardImages (core/platform/clipboard_images.dart), which reads
  the system clipboard through the new pasteboard dependency: a bitmap
  (browser copy, screenshot tool) or, on desktop, the image files copied in the
  file manager. Clipboard from flutter/services.dart only ever sees
  text/plain, so neither was reachable before.
• The composer takes Ctrl/Cmd+V over wholesale in _handleComposerKey: an
  image is attached, anything else is inserted as text at the caret. Letting
  the field also paste natively put the source URL of a copied picture into the
  box next to it.
• _buildContextMenu rebuilds the field's own selection toolbar with Paste
  rewired to the same handler, and adds the item when Flutter left it out —
  which it does whenever the clipboard holds no text, exactly the case an
  image paste has to survive. That is the long-press route on touch.
• The composer's TextField declares contentInsertionConfiguration, so
  pictures the on-screen keyboard commits — Gboard's clipboard chip and its
  sticker/GIF pickers — are attached too. Those never reach the clipboard at
  all, so no paste path could see them. Content the engine could not read (a
  content:// URI with no bytes, which nothing in Dart can open) is logged and
  dropped rather than attached empty.
• No new button anywhere: the system already offers paste wherever a paste is
  possible.
• encodeImageDataUrl sniffs the MIME type from the magic bytes rather than
  trusting the source. A clipboard bitmap has no filename and a keyboard names
  whichever of the requested types it likes; a mislabelled type is what makes a
  provider reject an otherwise valid multimodal request. A declared type is
  consulted only when the header says nothing, and Android's unregistered
  image/jpg is normalised to image/jpeg.

Carrying several images

• maxMessageAttachments (4, in core/models/chat_message.dart) caps the
  composer; the file picker takes several files at once and the preview strip
  becomes a row of square thumbnails past the first image.
• Storage keeps the attachments split — ChatMessage.imagePath is the first
  and the new extraImagePaths the rest — so sessions written before this
  still render. ChatMessage.attachments is the one list every reader uses and
  splitAttachments the one writer of the pair.
• PromptMessage now carries imagePaths instead of a single imagePath, and
  toApiMap() emits one image_url content part per image, in order. Every
  rebuild site that used to copy imagePath (HistoryAssembler.assemble,
  buildFallbackPrompt, applyPromptRegexes, StudioHistoryLimiter,
  StudioStreamInterceptor, the memory injector, both append-to-last builders)
  copies the list. The eye toggle still covers the whole message (INV-PS1b).
• ChatMessageMapper sends imagePaths alongside imagePath (still the
  first, for anything that only knows the single-image shape), and
  _resolveMappedFileUrls resolves each path, dropping any the WebView cannot
  reach instead of rendering a broken tile.
• The WebView renders one .msg-image-attachment block holding every picture:
  free-size for one, a tile grid for two to four (2-up, one tall plus two
  stacked, 2x2). Keeping it a single element is what lets updateMessage lift
  it out of the body and put it back, and what keeps one eye toggle per
  message.
• Recorded as INV-PS1c in docs/INVARIANTS.md.

Verified

Run against a local Flutter 3.44.9 (the same version CI pins):

• flutter analyze --no-fatal-infos --no-fatal-warnings — 9 issues, all of
  them pre-existing on nightly and none in the files this PR touches.
• flutter test — 3814 passed. New coverage: the paste shortcut end to end
  (clipboard image → thumbnail → data URL in the send callback), the fall
  through to a text paste when the clipboard holds no image, the fifth
  attachment being refused, the toolbar's Paste item, the content-insertion
  callback with and without bytes, the multi-part request, the pre-multi-attach
  JSON payload, and the MIME sniffing.
• cd test/webview_js && npm ci && npx playwright test — 81 passed, including
  a new attachments.spec.js that measures the grid a headless Chromium
  actually lays out for one to four images.

Not run: a real device or desktop build. The clipboard and keyboard paths cross
a platform channel, so they are covered here by mocked channels rather than by
a real Gboard.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MJ2H48SAD3gVT4wEeMRG4E

---

Generated by Claude Code