feat(cloud-agent): Show S3-backed image attachment thumbnails

[tatoalo]

Problem

Why: Image attachments in cloud task conversations only appear as filename chips, making similar screenshots difficult to distinguish.

Changes

Render image attachments as compact, labeled thumbnails in both chat views, with a full-size preview on click. Cloud task images resolve through the existing authenticated artifact manifest and short-lived S3 presigned URLs, while local and unavailable attachments retain their existing fallbacks.

[trunk-io]

😎 Merged directly without going through the merge queue, as the queue was empty and the PR was up to date with the target branch - details.

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 40a6fe6.}

[greptile-apps]

Security Review

Artifact manifests and presigned URLs are authorization-scoped, but the new cache keys omit account, project, and API-region identity. Authentication changes can therefore reuse artifact data obtained under a previous session.

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
packages/ui/src/features/sessions/components/UserMessageAttachments.tsx:37-42
**Preview Cache Omits Auth Scope**

When the active account, project, or cloud region changes, this key can reuse a presigned URL cached under the previous identity for the same task, run, and artifact IDs. Because the URL remains fresh for 50 minutes, the new session can display an attachment authorized for the previous session without calling the service's fresh authentication check.

### Issue 2 of 2
packages/core/src/sessions/sessionService.ts:7136-7137
**Manifest Dedupe Crosses Auth Sessions**

During an account, project, or region switch, a concurrent request with the same task and run IDs can receive the manifest promise created by the previous auth client because this singleton cache key omits project and API-host identity. The new session can consequently select a storage path from the previous tenant, producing a missing thumbnail or presigning the wrong artifact.

_{Reviews (1): Last reviewed commit: "feat(cloud-agent): show S3-backed image ..." | Re-trigger Greptile}