feat(attachments): add work package attachment tools (port upstream #24)

[AndreaV-Lsi]

Problem / motivation

The server has no tools for work package attachments — you can't list, read,
download, upload, or delete files attached to a work package. This is a common gap
for agentic project-management workflows (e.g. "attach this report to WP #1024",
"read the spec attached to this task").

Source / attribution

Port of upstream PR AndyEverything#24 by @i-matveev
("feat(attachments): add work package attachment tools"). That PR targets the same
modular layout as this fork, so it ports cleanly (add-only). Author to be credited
in NOTICE (see licensing/). Verified compatible with our OpenProjectClient
(uses existing self.headers, self.proxy, self._format_error_message, ssl).

Scope / proposed approach

Add 5 tools in a new src/tools/attachments.py + 5 client methods in src/client.py:

Tool	Description
list_attachments	List a work package's attachments
get_attachment	Attachment metadata
download_attachment	Content inline (text) or to disk via save_path; follows the storage redirect without forwarding the API key
upload_attachment	Upload a local file (multipart/form-data)
delete_attachment	Delete an attachment

• Register the module in src/server.py; update the tool-count log line.
• Add the 5 tools to the README catalog.
• Keep the upstream author's implementation as-is where it already fits our
  conventions (it does); adapt only names/counts to this fork.

Acceptance criteria

• All 5 tools import and register (server loads without error).
• Offline unit test (existing script style) passes: input-model validation +
  formatting/heuristic helpers.
• Live smoke on an ephemeral OpenProject: upload a file to a WP, list it, get its
  metadata, download it back (bytes match), delete it — all green.
• No changes to unrelated tools; add-only diff.

Out of scope

• No changes to the work-package tools (independent of the flattened-tools stack /
  PR fix: make wrapped tool inputs robust to MCP clients that serialize args as JSON strings AndyEverything/openproject-mcp-server#22, so this branches off main).
• No new dependencies (aiohttp/ssl/mimetypes already available).