publish: upload local files referenced by links, not just images

Bắt đầu với việc đăng ký attachment forward tại images.go:78, sau đó đọc attachname.go và withinRoot clamp dùng chung. So sánh cách xử lý liên kết với renderImage và kiểm tra mapping trong docs/confluence/links-and-anchors.md. Công việc được xem là hoàn tất khi các đích liên kết cục bộ đủ điều kiện không phải .md được upload và rewrite chính xác, trong khi các liên kết .md giữ nguyên hành vi URL trang hiện tại và việc render ri:attachment đảo chiều được cập nhật thông qua sourceFor.

read/export now pass an attachment link through as raw storage rather than converting it, because a markdown link to the exported file would break on the next publish. From the mapping table in links-and-anchors.md:

So this exports:

Grab <ac:link><ri:attachment ri:filename="Deck.ppt" /><ac:plain-text-link-body>the deck</ac:plain-text-link-body></ac:link>.

where Grab [the deck](Deck.ppt). would read better, preview locally, and reference the file export already downloads (it scans raw storage for ri:filename, not just ac:image, precisely so a link target is included).

What blocks it is the forward path, not the inverse one. Only images.go:78 registers an Attachment, so a local file named by a link destination is never uploaded, and republishing [the deck](Deck.ppt) emits <a href="Deck.ppt"> — a relative href that resolves to nothing on Confluence, with no warning and exit 0. That is the silent failure mode docs/confluence/links-and-anchors.md already calls out for unresolved doc links, and it is worse here because the link was working before the round trip.

The work is therefore in the forward direction first: treat a link destination that names a local non-.md file the way an image src is treated — resolve it page-relative, clamp it to the documentation root, register it as an attachment, and rewrite the href to the attachment. attachname.go's source-path↔attachment-name codec and the withinRoot clamp both already exist and are shared with images; what is missing is a link-side caller. Once a link target uploads, flip ri:attachment in the inverse mapping from passthrough to [body](path) via sourceFor, exactly as renderImage does.

Two things to decide when picking this up. Whether a link to a local file should upload it at all, or only when some marker says so — an unqualified rule means any [x](notes.txt) in a repo starts publishing that file as an attachment, which may be more than anyone asked for. And what .md siblings do, which must keep resolving to page URLs via the existing doc-link path rather than becoming attachments.

Split out of #88, where the passthrough decision was made.