Convert im_webapp from static mock prototypes to real backend integration

Implements all 11 product chapters (auth, messaging, contacts, groups,
files/favorites, calls, workplace/reports, settings, security) against the
real /v1/im REST API and native Tinode WS protocol, replacing the hardcoded
mock data the ba8f48ee prototype commit shipped with. Adds src/lib/im-api.js
as the REST client, plus supporting fixes across messages-view.jsx and the
attachment/upload/download pipeline (wrong SDK auth headers, group topic
naming, seq/timezone edge cases) found via live end-to-end testing against
the real backend.

Backup checkpoint before reconciling with origin/dev's parallel rewrite.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/widgets/attachment.jsx

@@ -2,6 +2,7 @@ import React from 'react';
 import { FormattedMessage } from 'react-intl';
 
 import FileProgress from './file-progress.jsx';
+import { createFileDownloader } from '../lib/im-api.js';
 import { bytesToHumanSize } from '../lib/strformat.js';
 import { isUrlRelative, sanitizeUrl } from '../lib/utils.js';
 
@@ -24,7 +25,11 @@ export default class Attachment extends React.Component {
       return;
     }
 
-    const downloader = this.props.tinode.getLargeFileHelper();
+    // Same wrong-header bug as content-library-view.jsx's DownloadPage (X-Tinode-APIKey/
+    // X-Tinode-Auth, neither recognized by this backend) -- confirmed live: clicking "保存" on any
+    // real chat file attachment 403'd with "valid API key required". createFileDownloader() is the
+    // fixed-headers drop-in with the same download()/cancel() interface.
+    const downloader = createFileDownloader(this.props.tinode);
     this.setState({downloader: downloader});
     downloader.download(url, filename, mimetype,
       loaded => this.setState({progress: loaded / this.props.size}),