MCP Add write_attachment tool

Tool: write_attachment (EDIT, write-gated)

• content XOR content_base64, 1M-char cap as the primary size guard, AttachmentValidator still invoked for admin-tightened policy.
• `base_version` mirrors write_object: required when the document exists, omitted creates it carrying the attachment.
• save path is the REST pattern - clone, setAttachment, validate, resetMimeType, save - inside the existing lock + race recovery. Echoes both versions: the attachment's own (1.1 -> 1.2) and the document's with the `base_version` hint.