feat: media preview as image content and download as embedded resource

lit/media-preview downscales an image attachment via wp_get_image_editor
and returns it as ImageContent; lit/media-download returns a file (full
or a named size) as an embedded resource, rejecting files above the
upload limit. Both are direct tools (ruling Q6: embedded resources, like
ImageContent, only become content blocks for tools called directly).
Adds MediaFiles::isWithinUploads() so neither tool ever reads a file
outside wp_upload_dir()'s basedir.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Integrations/Media/MediaIntegrationTest.php

@@ -18,6 +18,8 @@ final class MediaIntegrationTest extends TestCase
     private const EXPECTED = [
         'lit/media-search',
         'lit/media-get',
+        'lit/media-preview',
+        'lit/media-download',
     ];
 
     public function testProvidesTheMediaAbilities(): void