fix(plugin): pass only local MediaPaths (drop SSRF-blocked MediaUrls)

Live round-trip test showed openclaw's SSRF guard blocking the
localhost guild file URL passed via MediaUrls. We already download the
bytes with the agent's guild token, so MediaUrls is redundant and
noisy — provide only local MediaPaths/MediaTypes. Verified: plugin
logs 'fetched N attachment(s)' and the SSRF WARN is gone.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dist/fabric/src/inbound.js

@@ -173,14 +173,16 @@ export class FabricInbound {
                 Timestamp: m.createdAt ? Date.parse(m.createdAt) : Date.now(),
                 OriginatingChannel: 'fabric',
                 OriginatingTo: `fabric:${channelId}`,
+                // Provide ONLY local paths. The guild file URL is on a private host
+                // (e.g. localhost); openclaw's SSRF guard blocks re-fetching it, so
+                // passing MediaUrls is both redundant (we already downloaded the
+                // bytes) and noisy. Local MediaPaths is the reliable delivery.
                 ...(media.paths.length
                     ? {
                         MediaPaths: media.paths,
                         MediaTypes: media.types,
-                        MediaUrls: media.urls,
                         MediaPath: media.paths[0],
                         MediaType: media.types[0],
-                        MediaUrl: media.urls[0],
                     }
                     : {}),
             });