fix(mcp): use documented OpenAI file schema

[uvwt]

Summary

• expose file_publish.file with the documented OpenAI file object fields
• require download_url and file_id while keeping file_name and mime_type optional
• support secure download_url ingestion with size limits, cleanup, redirect bounds, and SSRF protection
• keep existing connector-mounted local-path compatibility
• add regression coverage for schema, download behavior, and blocked network ranges

Validation

• go test ./internal/tool/media ./internal/mcp ./internal/app
• go test ./...
• git diff --check