feat(studio): save and preview session artifacts

[evanlowe]

Studio conversations can now save generated files to the existing Studio TOS bucket and open them from a persistent artifact button above the composer. The studio_write_artifact tool runs in the BFF through the existing tool channel and writes to artifacts/{user_id}/{session_id}/{relative_path} using the authenticated conversation identity and Studio credentials, including IAM role STS credentials

The drawer provides a file tree, preview, refresh, pagination, and download. HTML previews use a scriptless sandbox and authenticated relative images. Bounded preview caches, reply-time prefetching, and pooled storage clients reduce repeated preview latency

Agent creation, generated code, default system prompts, and Runtime mounts are unchanged. This PR contains no offline binding script. Existing artifact mounts remain readable when no Studio bucket is configured

Validation:

• 125 focused backend tests; Ruff, targeted Pyright, pre-commit, and secret scan passed
• 1,196 frontend tests on Node 22, 19 artifact interaction/cache tests, and 4 asset-reference regression tests passed
• TypeScript check and production builds passed; verified 113 packaged assets and 350 internal references
• Local Studio → real Volcengine and BytePlus Runtime → TOS → Studio content APIs verified for HTML, SVG, and Markdown, with matching SHA-256 digests and cross-user/session isolation checks
• Clean Agents on an unmounted Volcengine Runtime and a BytePlus Runtime automatically selected the Studio tool for an ordinary story-to-Markdown request; tool, storage, and preview API hashes matched
• Cloud Volcengine Studio: authenticated browser conversation confirmed studio_write_artifact saved a Markdown story; the session artifact drawer listed the file and rendered its full Markdown content

Cloud validation limit: BytePlus cloud Studio deployment is blocked by exhausted VeFaaS memory quota; the local Studio to BytePlus Runtime flow passed