feat(tasks): implement attach subcommand with multipart file upload

[nico-fioretti]

Summary

The attach subcommand of vikunja_tasks was already declared in the schema but handleAttach() only threw NOT_IMPLEMENTED. This PR ships the real implementation against the Vikunja REST endpoint PUT /tasks/{id}/attachments (multipart/form-data, field name files).

Uses Node 22 native fetch / FormData / Blob, so no new dependencies.

What's in it

New module src/tools/tasks/attach.ts:

• attachSchemaFields — three optional zod fields spread into the tool schema:
  • filePath: absolute path readable by the MCP server process.
  • fileContent: base64-encoded contents (useful when the MCP client runs on a different host than the server).
  • filename: optional; defaults to basename(filePath) or attachment.bin. Any directory component injected via filename is stripped before upload.
• handleAttach(args, authManager):
  1. Validates id is a positive number.
  2. Reads bytes from filePath (fs.readFileSync) OR decodes base64 fileContent. filePath wins when both are provided.
  3. Rejects an empty decoded buffer with an explanatory error.
  4. Builds FormData and PUTs to {apiUrl}/tasks/{id}/attachments with Authorization: Bearer of the active session.
  5. Propagates the HTTP status and body on non-OK responses; wraps network errors with an attach: prefix.
  6. Returns an MCP text response with a JSON summary (taskId, filename, bytes, source) and the raw backend response.

src/tools/tasks/index.ts: import the module, spread attachSchemaFields into the zod schema, rewire the dispatch from handleAttach() to handleAttach(args, authManager). The inline stub is removed.

Tests

• tests/tools/tasks/attach.test.ts — 13 unit tests, all passing. Cover: missing id; zero / negative id; missing filePath + fileContent; empty decoded fileContent; filePath read with basename fallback; missing-path error; base64 decode with default filename; explicit filename; filePath precedence over fileContent; directory-component stripping in filename; trailing-slash stripping on apiUrl; HTTP non-OK status + body propagation; network error wrapping.
• tests/tools/tasks.test.ts — existing integration test updated: assertion changed from File attachments are not supported in the current MCP context to attach requires filePath or fileContent (same call shape).

Lint + typecheck clean. No regressions vs. upstream main baseline (touch points isolated to the attach dispatch).

Verified end-to-end

Against a live Vikunja instance via the MCP wrapper:

• fileContent (base64) for 19-byte .txt and 6594-byte .xml → both uploaded, visible in the UI, byte-exact (mime auto-detected).
• filePath pointing to a missing path → clear error: attach: cannot read filePath ...: ENOENT: no such file or directory.

Compatibility notes

• The handler signature changes from sync-throw to async; observable behavior is identical (.rejects.toThrow(...) keeps working for the error path).
• additionalProperties on the tool schema is unchanged — the three new fields are additive and optional. Existing callers that don't pass them are unaffected.
• The MCP server now needs network reachability to the Vikunja host (it already did for every other tool).