feat(core): attachments and credential encryption

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/TODO.md

@@ -9,6 +9,7 @@ Small, specific, independently actionable. Remove only when actually done.
 
 ## Next
 - [ ] Phase 2 and Phase 3 plans (spec §12).
+- [ ] Generate image thumbnails for attachments (Phase 1 sizes images with CSS).
 
 ## Someday