fix: WeasyPrint URL fetcher + attachment improvements + webhook error propagation + WebSocket conversation check + RLS disabled on system tables (bootstrap fix)

app/services/attachment_service.py

@@ -50,6 +50,11 @@ async def save_attachment(
     is_system_admin: bool = False,
 ) -> dict[str, Any]:
     """Save a file to storage and create an Attachment record."""
+    # File size limit: 50MB
+    MAX_FILE_SIZE = 50 * 1024 * 1024  # 50 MB
+    if len(file_content) > MAX_FILE_SIZE:
+        raise ValueError(f"File too large: {len(file_content)} bytes (max {MAX_FILE_SIZE})")
+
     # Check access on parent entity
     if not is_system_admin:
         from app.core.visibility import check_single_entity_access
@@ -151,7 +156,7 @@ async def delete_attachment(
     attachment_id: uuid.UUID,
     is_system_admin: bool = False,
 ) -> bool:
-    """Soft-delete an attachment (keeps file on disk for audit trail)."""
+    """Soft-delete an attachment and remove physical file from storage."""
     q = select(Attachment).where(
         Attachment.id == attachment_id,
         Attachment.tenant_id == tenant_id,
@@ -169,6 +174,13 @@ async def delete_attachment(
         if not has_access:
             raise PermissionError("No access")
 
+    # Delete physical file from storage (P1.1 fix)
+    try:
+        storage = get_storage_backend()
+        await storage.delete(attachment.file_path)
+    except Exception as exc:
+        logger.warning("Failed to delete physical file %s: %s", attachment.file_path, exc)
+
     attachment.deleted_at = datetime.now(UTC)
     await db.flush()
     await log_audit(