fix: resolve ServeMux conflict between attachments and SMTP message routes

[butschster]

What

Server panics at boot with pattern "GET /api/smtp/{eventUuid}/attachments/{uuid}" ... conflicts with pattern "GET /api/smtp/message/{uuid}/raw". This PR nests the attachment routes under a literal /attachments/ segment so they no longer collide with the SMTP module's 4-segment routes.

Why

The attachment API was registered as /api/{module}/{eventUuid}/attachments/{uuid} — wildcard at position 2. After #334 added /api/smtp/message/{uuid}/raw, both 4-segment patterns claim /api/smtp/message/attachments/raw and Go 1.22's ServeMux refuses to register them.

panic: pattern "GET /api/smtp/{eventUuid}/attachments/{uuid}" ...
       conflicts with pattern "GET /api/smtp/message/{uuid}/raw":
       But neither is more specific than the other.

How

• internal/server/http/attachments.go — routes are now /api/{module}/attachments/{eventUuid}[/{uuid}][/preview/{uuid}]. The attachments literal at position 2 makes them disjoint from any future module-specific route at position 2.
• modules/httpdumps/handler.go:109 — the generated attachment URI follows the new layout.
• Companion frontend PR: buggregator/frontend#282 updates src/shared/lib/io/use-attachments.ts to call the new paths. Both PRs must land together.

Testing

• internal/server/http/attachments_test.go (new) — registers RegisterAttachmentAPI and the SMTP module on the same mux and asserts no panic. Without the fix this panics at registration.
• go test ./... -count=1 clean; go vet ./... clean.

Note

PR #335 is independent and can be rebased on top of this once it lands.