Feat: AttachmentController.java

POST   /api/attachments/record/{recordId}   → upload file (multipart/form-data)
GET    /api/attachments/{id}/download       → download file
DELETE /api/attachments/{id}               → delete file
GET    /api/attachments/record/{recordId}   → list attachments for a record