Delete an attachment and its stored file

302-redirects to a presigned R2 URL valid for 60 seconds. Registered outside the authenticated group because an <img src> cannot send a bearer header — but NOT open. The caller must present a `t` view token from getAttachmentToken whose scope reaches the file: the same workspace, and either an org-wide team or one the bearer belongs to. The attachment's owner is found through its parent: its issue, or the issue its comment sits on. A bearer token is NOT an alternative here, and sending one has no effect: this route runs outside the authentication middleware, so there are no verified claims for it to read. An API caller fetches a view token first and appends it — one way in, verified in one place. Everything else is a 404, never a 403 — a wrong workspace, another team's file, an expired or forged token, no credentials at all, a deleted attachment, and an orphan whose parent is gone all answer identically, so the response never confirms that an id names a real file somewhere. 501 when storage is not configured. Limited per caller IP (EAS-77): a caller that sends too many requests gets 429 with a Retry-After header. The limit is generous, sized for a page that loads every image on an issue at once. If the rate-limit store is unavailable the request is served without a limit.