fix(chat): image attachment previews render as empty boxes — CSP blocks blob: URLs