uploads: centralise via ChatHubApi::save_upload, refactor handlers

Extract shared upload seam in skald-core, move Telegram and web
handlers to use it. Simplify media attachment routing. Clean up
unused deps and dead code.

crates/core-api/src/chat_hub.rs

@@ -5,7 +5,7 @@ use tokio::sync::broadcast;
 
 use crate::events::GlobalEvent;
 use crate::interface_tool::InterfaceTool;
-use crate::message_meta::MessageMetadata;
+use crate::message_meta::{Attachment, MessageMetadata};
 
 // ── SendMessageOptions ────────────────────────────────────────────────────────
 
@@ -59,6 +59,20 @@ pub trait ChatHubApi: Send + Sync {
         opts: SendMessageOptions,
     ) -> anyhow::Result<()>;
 
+    /// Persist an uploaded file for `source_id` into the owner's
+    /// `~/uploads/{session}/` and return its [`Attachment`] (home-relative agent
+    /// path). Channel adapters (e.g. the Telegram plugin) call this instead of
+    /// writing files themselves, so the core owns *where* uploads land and every
+    /// surface produces a path the agent can actually reach. The recognized
+    /// magic-byte MIME wins over the caller-claimed `client_mime`.
+    async fn save_upload(
+        &self,
+        source_id: &str,
+        file_name: &str,
+        client_mime: Option<String>,
+        bytes: &[u8],
+    ) -> anyhow::Result<Attachment>;
+
     /// Create a new session for the source, discarding the previous one.
     async fn clear(&self, source_id: &str) -> anyhow::Result<i64>;