feat(upload): pending lifecycle for upload-on-select images

Mark front-end uploads (comment/ticket/report) as pending, return the
attachment id, discard own pending uploads on remove via
DELETE /upload/pending/{id}, claim referenced URLs on successful submit,
and purge unclaimed uploads older than 24h with an hourly cron.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

assets/js/report.js

@@ -202,7 +202,17 @@
         remove.className = 'remove';
         remove.setAttribute('aria-label', '删除图片');
         remove.innerHTML = '×';
-        remove.addEventListener('click', function () { item.remove(); });
+        var uploadId = result.data && result.data.id;
+        remove.addEventListener('click', function () {
+          item.remove();
+          // 删除服务端待认领附件；失败由定时任务兜底清理。
+          if (uploadId) {
+            window.fetch(API_ROOT + '/upload/pending/' + encodeURIComponent(uploadId), {
+              method: 'DELETE',
+              headers: { 'X-WP-Nonce': NONCE },
+            }).catch(function () {});
+          }
+        });
         item.appendChild(img);
         item.appendChild(remove);
         preview.insertBefore(item, preview.querySelector('.add'));