#221: image paste view fixes

- image pastes scale to fit the viewer box (max-width/max-height, object-fit)
- no text/code box rendered below the image for image pastes
- link pill positioning cleaned up on the image view
- /raw for attachment pastes redirects to the file itself
- view details size now uses the attachment blob size, not empty text len

internal/api/server.go

@@ -451,6 +451,14 @@ func (a *apiServer) handleRaw(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "not found", 404)
 		return
 	}
+	// #221: an attachment paste has no text content; raw view must serve the
+	// file itself, not empty text. Redirect to the /f/ serving route, which
+	// applies the same sniffed-mime + disposition safety rules.
+	if att, err := a.store.GetAttachmentForPaste(row.ID); err == nil && att != nil {
+		a.store.IncrementViews(row.ID, "", 0) // raw views always count (#49/#95)
+		http.Redirect(w, r, "/f/"+att.ID+"/"+att.Filename, http.StatusFound)
+		return
+	}
 	// #34: content_type is attacker-controlled via the create API. Serving it
 	// verbatim let a paste be stored with text/html (or image/svg+xml) and
 	// render as active content on this origin when fetched from /raw —