MCP: add attachment tools (list, add, get, delete) #287

The MCP server in development (#268, with the follow-ups #279, #280 and #283) exposes epics, user stories, tasks, issues, milestones, wiki pages and custom attributes, but no way to work with attachments.

Problem

An agent using the MCP server cannot attach a file to an epic, user story, task, issue or wiki page, nor list, download or delete the attachments already there. In practice the agent has to stop and hand the user a curl command for POST /api/v1/<object>/attachments, which also needs the user's token. The client library already models attachments (taiga/models/models.py), so the gap is in the MCP layer only.

Proposal

Add attachment tools to taiga.mcp_server, following the conventions of the existing tools (project + ref, payload/fields reduction, return_representation):

• list_attachments(project, object_type, ref): for epic, userstory, task, issue, wiki_page.
• add_attachment(project, object_type, ref, file_path, description=None): upload a local file.
• get_attachment(id): metadata and URL; optionally download to a given directory.
• delete_attachment(object_type, id).

Points to settle

• File access: the server reads file_path from the machine it runs on. Decide whether to restrict it to an allowed base directory (setting or CLI flag) and to cap the size.
• Downloads: whether the tool writes to disk or returns the URL only. Returning content inline would be too large for the model context.
• Confirmation: uploads and deletions are outward-facing; mark them as destructive/write tools like the other write tools so clients can ask for confirmation.
• Tests: unit tests with a mocked API for each object type, plus a case for a missing file and a file outside the allowed directory.
• Docs: list the tools in the MCP documentation and in HISTORY.rst.

Context

Found while attaching a document to an epic through the MCP server: every tool needed was available except attachments.