Feature request: support downloading inline blob attachment

[Bjorci]

Currently the CLI (and Basecamp 3 API generally) makes it impossible to programmatically download inline attachments embedded in messages, comments, and todos. These are stored at storage.3.basecamp.com and require a browser session cookie — requests with an API bearer token return 404, and unauthenticated requests redirect to the sign-in page.

By contrast, files uploaded to the vault (3.basecampapi.com/.../uploads/.../download) are downloadable with a bearer token and work well.

The gap: Inline attachments — PDFs, images, code files, spreadsheets dropped directly into a message body — are completely inaccessible outside a browser. There is no API endpoint to exchange a bearer token for a session-authenticated download URL, and the CLI exposes no download command.

What I'm trying to do: Build an automated sync tool that pulls all Basecamp project content (messages, todos, attachments) into a local folder for offline use in a research workflow. Vault files work fine. The inline blobs are a dead end.

Request: One of the following would solve this:

A CLI command like basecamp download that uses the stored OAuth session to fetch blob URLs.
An API endpoint that exchanges a bearer token + blob SGID for a time-limited signed download URL (similar to how some services issue presigned S3 URLs via API).

Documentation of any existing workaround if one exists.

Is there a supported path for this, or is it intentionally restricted?

[brianevanmiller]

@jeremy - let me know if you'd like me to address items like this as well.

I did some research, here's a prompt you can feed yourself, or I can iterate and PR on this:

You are implementing inline blob attachment download support for the Basecamp CLI
(GitHub issue #290).

### Problem
Inline attachments (files embedded in messages, comments, todos via drag-and-drop)
are stored on storage.3.basecamp.com and cannot be downloaded with a plain bearer
token. The SDK already solves the auth problem via URL rewriting in DownloadURL()
(pkg/basecamp/download.go), and `basecamp files download <storage-url>` works.
What's missing is a way to extract attachment URLs from rich text and batch download.

### What to build

1. **Enhance `InlineAttachment`** in `internal/richtext/richtext.go`:
   - Add `URL string` field (for the `url=` attribute on `<bc-attachment>` tags)
   - Add precompiled regex `reAttrURL` matching `url="..."`
   - Add `DownloadURL() string` method: returns URL if non-empty, else Href
   - Extract `url` in `ExtractAttachments()` alongside existing `href`

2. **Add `basecamp files extract <recording-url|id>` command** in `internal/commands/files.go`:
   - Fetches a recording (message, todo, comment, etc.) and lists its inline attachments
   - Uses `richtext.ExtractAttachments()` on the recording's `content` field
   - Output: structured JSON with url, href, filename, filesize, content_type, sgid
   - Text output: table with filename, type, size, download URL
   - Accepts Basecamp URLs or numeric IDs with --in/--type flags

3. **Add `--from` flag to existing download command**:
   - `basecamp files download --from <recording-url>` fetches the recording,
     extracts all inline attachments, downloads each via `app.Account().DownloadURL()`
   - Reuse `writeDownloadToFile()` for each attachment
   - Report progress: "Downloaded 3/5: report.pdf (1.2mb)"

4. **Register in catalog** (`commands.go`) and update skill docs (`skills/basecamp/SKILL.md`)

### Patterns to follow
- Command constructors: `newFilesExtractCmd(project *string) *cobra.Command`
- Output: `app.OK(data, output.WithSummary("..."), output.WithBreadcrumbs(...))`
- Errors: `output.ErrUsage()`, `output.ErrNotFound()`, `convertSDKError(err)`
- URL parsing: see `extractWithProject()` in files.go for URL-or-ID resolution
- File writing: see `writeDownloadToFile()` in files.go for download-to-disk pattern

### Key constraint
The SDK's `DownloadURL()` handles the storage URL auth transparently (rewrites host,
sends bearer token, follows redirect to signed URL). Do NOT try to implement custom
auth or cookie-based download. Just pass the attachment URL to `DownloadURL()`.

### Verification
Run `bin/ci` before pushing. This runs formatting, vetting, linting, unit tests,
e2e tests, catalog parity checks, skill drift detection, and more.

[jeremy]

Thanks @brianevanmiller! I've got this one cooking already (I'm adding attachments to the API so they needn't be extracted from the HTML at all). Please do dig in anywhere you're interested, otherwise!