feat: implement attachment business logic layer

- Add AttachmentInterface to main model interface
- Implement attachment CRUD operations with permission checking
- Add GetTransaction method for secure attachment access validation
- Add accountsContainReadAccess for permission verification
- Ensure users can only access attachments for authorized transactions

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

core/model/account.go

@@ -408,6 +408,15 @@ func (model *Model) accountsContainWriteAccess(accounts []*types.Account, accoun
 	return false
 }
 
+func (model *Model) accountsContainReadAccess(accounts []*types.Account, accountId string) bool {
+	for _, account := range accounts {
+		if account.Id == accountId {
+			return true
+		}
+	}
+	return false
+}
+
 func (model *Model) getAccountFromList(accounts []*types.Account, accountId string) *types.Account {
 	for _, account := range accounts {
 		if account.Id == accountId {