#38 iteration 1: file attachments, 1 file per paste

- internal/store/blob.go: BlobStore interface + fs implementation with
  traversal-safe keys (<paste-id>/<sha256>), put/get/stat/delete
- attachments table migration (id, paste_id, filename sanitized to 255,
  mime sniffed server-side, size, sha256, created_at)
- POST /api/pastes now accepts multipart/form-data with a 'file' part;
  1 file = 1 paste: file replaces text content when both are sent
- 25 MB per-file limit enforced server-side (413 file_too_large)
- GET /f/{attachment-id}/{filename}: stored sniffed mime, nosniff,
  inline only for images/pdf, html/svg/xml forced to text/plain (#34 rule)
- paste view renders attachment chip + inline image preview
- /new: dropzone with file picker, drag-and-drop, Ctrl+V file paste,
  file chip with name/size/remove, matches pill/radius design
- tests: blob roundtrip/traversal/sanitize; multipart create (mime
  sniffing, client mime ignored, size limit, two-file reject, html/svg
  forcing, 404s, password/expiry fields)

internal/web/static/app.css

@@ -219,6 +219,14 @@ body {
 .iconbtn.dark-toggle .icon-sun { display: inline-block; }
 .dark .iconbtn.dark-toggle .icon-sun { display: none; }
 .dark .iconbtn.dark-toggle .icon-moon { display: inline-block; }
+/* #127: gear highlights like selected nav tabs; dark toggle button */
+.iconbtn.gear.on { background: var(--accent); color: var(--bg); border-color: var(--accent); }
+.iconbtn.dark-toggle { display: inline-flex; align-items: center; gap: 6px; padding: 5px 9px; }
+.iconbtn.dark-toggle svg { width: 22px; height: 22px; }
+.iconbtn.dark-toggle .icon-moon { display: none; }
+.iconbtn.dark-toggle .icon-sun { display: inline-block; }
+.dark .iconbtn.dark-toggle .icon-sun { display: none; }
+.dark .iconbtn.dark-toggle .icon-moon { display: inline-block; }
 .settings-head { padding: 12px 18px; border-bottom: 1px solid var(--border); }
 .settings-head h1 { font-size: 29.2px; font-weight: 600; margin: 0; }
 .settings-body { padding: 16px 18px; color: var(--muted-fg); font-size: 21.6px; }
@@ -502,6 +510,9 @@ a.admin-link:hover { color: var(--fg); text-decoration: underline; }
   .iconbtn.dark-toggle { padding: 4px 7px; flex-shrink: 0; }
   .iconbtn.dark-toggle svg { width: 18px; height: 18px; }
   .iconbtn.dark-toggle span { display: none; }
+  .iconbtn.dark-toggle { padding: 4px 7px; flex-shrink: 0; }
+  .iconbtn.dark-toggle svg { width: 18px; height: 18px; }
+  .iconbtn.dark-toggle span { display: none; }
 
   /* new paste: stack editor above sidebar, natural page height */
   .deck {