The optional-column story the File Activity card already documents gains its
second consumer: `/api/dsh-context/attachment`, what it authorizes (only an id
the session's own log cites, and where the harness's gateway is stricter
still), how a verbatim file's named alias differs from the hard link a
suffixless image object needs, and what degrades when a face is absent.