fix(teams): authenticate protected inline attachments

[onmax]

Summary

Authenticates connector-hosted Teams inline attachments through the configured Bot Framework client, so message.attachments[].fetchData() can retrieve protected content. Teams file download cards use their direct content.downloadUrl anonymously, and serialized attachments reconstruct the same routing during rehydration.

Bot credentials are limited to non-redirecting HTTPS requests whose origin exactly matches the Activity connector origin. Cross-origin URLs, HTTP URLs, and file-card download URLs never enter the authenticated client path.

File-card MIME inference covers common image and text formats plus PDF, XLS, and XLSX attachments.

The implementation follows Microsoft's inline-image access-token sample and Teams file-card contract.

Test plan

• pnpm validate
• pnpm --filter @chat-adapter/teams test — 20 files and 257 tests passed
• pnpm --filter @chat-adapter/teams typecheck
• pnpm --filter @chat-adapter/teams... build
• Coverage includes authenticated same-origin retrieval with redirects disabled, anonymous file-card/cross-origin/HTTP retrieval, PDF/XLS/XLSX and leading-dot MIME inference, bot and anonymous rehydration, invalid metadata failing closed, and the existing protected fetch override

Possible follow-up

Evaluate image-meta for consolidating image type and dimension detection from downloaded bytes across adapters. It does not replace this adapter's pre-fetch authentication routing or its PDF/Excel file-card MIME inference, so this PR deliberately adds no dependency or lockfile change.

Checklist

• All commits are signed and verified
• All commits are signed off for the DCO (git commit -s)
• pnpm validate passes
• Changeset added (or N/A — see CONTRIBUTING.md)
• Documentation updated (or N/A)

[vercel]

@onmax is attempting to deploy a commit to the Vercel Team on Vercel.

A member of the Team first needs to authorize it.