forked from mirror/crumbs-original
The "notes, tags, and attachments" scenario previously only created a note and an API key — no attachment. Upload a PNG via the browser context so Origin is set correctly for SvelteKit's CSRF check, giving the atomic-delete path genuine attachment rows to clean up. https://claude.ai/code/session_015T2HE6VzB64ZmSSyy1Wz4R