feat(web): add blob upload/download client for artifact management

- getArtifactUploadUrl() — SAS URL with write permissions
- uploadArtifact() — direct browser-to-blob upload via SAS
- downloadArtifact() — fetch blob content via SAS read URL
- Uses platform-service /blob/sas endpoint for SAS token generation

Verification: web typecheck passes.

web/src/lib/blob-client.ts

@@ -16,3 +16,42 @@ export async function getArtifactReadUrl(blobPath: string): Promise<string> {
 
   return response.sasUrl;
 }
+
+export async function getArtifactUploadUrl(blobPath: string): Promise<string> {
+  const response = await platformClient.post<BlobSasResponse>("/blob/sas", {
+    container: "attachments",
+    blobName: blobPath,
+    permissions: "cw",
+    expiresInMinutes: 30,
+  });
+
+  return response.sasUrl;
+}
+
+export async function uploadArtifact(
+  file: File,
+  blobPath: string,
+): Promise<{ blobPath: string; contentType: string; sizeBytes: number }> {
+  const sasUrl = await getArtifactUploadUrl(blobPath);
+
+  await fetch(sasUrl, {
+    method: "PUT",
+    headers: {
+      "x-ms-blob-type": "BlockBlob",
+      "Content-Type": file.type || "application/octet-stream",
+    },
+    body: file,
+  });
+
+  return {
+    blobPath,
+    contentType: file.type || "application/octet-stream",
+    sizeBytes: file.size,
+  };
+}
+
+export async function downloadArtifact(blobPath: string): Promise<Blob> {
+  const sasUrl = await getArtifactReadUrl(blobPath);
+  const response = await fetch(sasUrl);
+  return response.blob();
+}