fix(frontend): scope session attachment uploads to the session project

The composer upload sent only session_id, so the API fell back to the callers default project and stored the attachment there. The runner, scoped to the sessions real project, then got 404 and never read the file. Send the sessions project_id on upload like every other session-scoped call, make it a required uploadAttachment param, and guard the pre-hydration null.