Finalize attachment

Finalize a shipment attachment after direct upload.

This is step 2 of the shipment attachment workflow.

Validation pipeline:

• Validates that imageId matches the expected shipment attachment URN.
• Confirms shipment ownership and time-window eligibility.
• Ensures image upload is complete (not draft).
• Runs moderation and rejects unsuitable content.

Responses:

• 451 when moderation rejects the image.
• 400/403/404 for invalid ID, disabled uploads, or missing shipment.
• Returns saved attachment metadata on success.