fix: message detail shows only its own images, not everyone's

useMessageDetail fetch attachments per-channel -> detail view nampilin
10 image terbaru di channel itu (semua orang), bukan image pesan yang
diklik. Root cause: getAttachmentsByChannel cuma filter channel_id.

- backend: messageQuerySchema + messageId optional; repository
  tambah eq(message_id) pas messageId ada. Sudah ada index
  idx_attachments_message.
- frontend: getAttachments(channelId, limit, cursor, messageId);
  useMessageDetail pass id pesan.

Verifikasi: backend tsc PASS, frontend tsc PASS + next build PASS.
E2E local (tsx + env prod, port 3901): tanpa messageId -> 3 row
(termasuk image.png punya message lain); dengan messageId -> tepat
2 row milik pesan itu. psql juga konfirmasi channel-only 3 vs
message-filtered 2.

services/backend/src/modules/messages/messages.repository.ts

@@ -385,6 +385,12 @@ export class MessagesRepository {
     const limit = query.limit ?? 50;
     const conditions: SQL[] = [eq(pgAttachmentsTable.channel_id, channelId)];
 
+    // Detail view: narrow to the selected message so we don't show
+    // everyone else's images from the same channel.
+    if (query.messageId) {
+      conditions.push(eq(pgAttachmentsTable.message_id, query.messageId));
+    }
+
     if (query.cursor) {
       conditions.push(lt(pgAttachmentsTable.created_at, Number(query.cursor)));
     }

services/backend/src/modules/messages/messages.schema.ts

@@ -8,6 +8,8 @@ export const messageQuerySchema = z.object({
   limit: z.coerce.number().int().positive().default(50),
   offset: z.coerce.number().int().nonnegative().default(0),
   cursor: z.string().optional(),
+  // Filter attachments to a single message (used by the message detail view)
+  messageId: z.string().optional(),
 });
 
 export const messageCreateSchema = z.object({