📎 fix: Translate Finite supportedMimeTypes Allowlists to Picker Accept (#14186)

* 📎 fix: Translate Finite supportedMimeTypes Allowlists to Picker Accept

Finite supportedMimeTypes allowlists were never reflected in the Upload
to Provider file picker: only permissive configs (.*) cleared the accept
filter (#12596); finite lists fell back to the hardcoded provider filter,
so configured Office types (.docx/.xlsx) could not be selected.

Add getConfiguredMimeAccept in file-config.ts, which resolves the picker
accept from the configured allowlist by testing candidate MIME types
against the actual RegExp patterns (robust to any regex shape). It
collapses media to image/audio/video wildcards and maps document types
to extension + MIME tokens. Returns undefined for the built-in default or
an untranslatable config (keep provider filter) and '' for permissive
configs. AttachFileMenu now uses it, folding all three cases into one
check with the hardcoded filters as fallback.

* 🩹 fix: Fall back when a configured type is unrepresentable

Codex review: buildMimeAccept could emit a partial accept string when a
finite allowlist mixed a recognized type with a supported-but-unrecognized
one, hiding files the provider fallback filter would have shown (e.g. mp3
alongside pdf). Add a coverage guard that returns undefined unless every
configured pattern maps to a recognized type, so unrepresentable configs
keep the provider filter instead of a narrower partial. Widen the media
samples to match fullMimeTypesList so common audio/video configs still
translate rather than falling back.

* 🎯 fix: Intersect picker accept with provider upload capability

Codex review (3 findings): translating the validation allowlist wholesale
let the picker expose types the specific provider upload path silently
drops — PDFs/Office on the image-only path, audio/video on document
providers that aren't Google/Vertex/OpenRouter, and broad regexes (e.g.
application/.*) matching supported types the catalog can't represent.

Rework the translation to intersect the configured allowlist with the
categories the current upload path can send. getConfiguredMimeAccept now
takes the permitted MimeUploadCategory set; buildMimeAccept scans the
known-MIME universe, skips categories the path can't handle, and returns
undefined (keep the provider filter) if a permitted-category match is
unrepresentable. AttachFileMenu maps each fileType to its capability.

* 🪨 fix: Scope Bedrock document accepts and infer Office MIME types

Codex review (2 findings):
- Bedrock's document path only sends bedrockDocumentFormats (pdf/csv/doc/
  docx/xls/xlsx/html/txt/md), but the generic document capability exposed
  pptx/ODF/etc. that validate and upload yet are dropped from the payload.
  MimeUploadCapability now carries an optional documentMimeTypes allow-set;
  image_document_extended passes bedrockDocumentMimeTypes so the picker is
  scoped to Bedrock-supported formats.
- Office files (.doc/.docx/.xls/.xlsx/.ppt/.pptx) had no codeTypeMapping
  entry, so inferMimeType returned '' when the browser reported no type,
  failing client validation with 'Unable to determine file type' before
  the configured allowlist could accept them. Add the extension mappings.

* 🧩 fix: Add .htm/.yml aliases and cap Google docs to PDF

Codex review (2 findings):
- documentMimeExtensions now maps each MIME to multiple extensions so
  text/html emits both .html and .htm (matching bedrockDocumentExtensions
  and inferMimeType), and application/yaml emits .yaml and .yml. Without
  the alias, extension-based file dialogs hid selectable .htm files that
  validation accepts.
- image_document_video_audio (Google/Vertex/OpenRouter) now scopes
  documentMimeTypes to application/pdf, matching the isProviderAttachType
  predicate and hardcoded fallback (files.ts:366-372); those paths only
  treat PDF as a viable document, so a config with docx/xlsx no longer
  advertises files the media path would drop.

* 🎧 fix: Sync media samples to regexes and fall back on unknown patterns

Codex review: a finite media allowlist with a subtype missing from the
sample list (e.g. audio/webm) matched nothing in knownMimeUniverse, so it
was silently ignored and the picker hid a valid audio upload the previous
audio/* filter allowed. Two-part fix:
- Media samples now mirror imageMimeTypes/audioMimeTypes/videoMimeTypes
  exactly, so every backend-accepted media type is in the universe and
  translates to its wildcard.
- buildMimeAccept falls back (undefined) when any configured pattern
  matches nothing in the universe, so future sample/regex drift or an
  unrepresentable type yields the provider filter, never a partial that
  hides a supported file.

* 📑 fix: Represent Excel aliases and epub/parquet in picker accept

Codex review (2 of 3 findings): finite allowlists using backend-supported
document types outside documentMimeExtensions fell back to the provider
filter and hid the files.
- Canonicalize the legacy Excel MIME aliases (application/msexcel,
  x-ms-excel, xls, etc. — matched by the excelMimeTypes regex) to .xls so
  an excel-pattern config translates instead of falling back.
- Add application/epub+zip (.epub), the parquet variants (.parquet), and
  x-zip-compressed (.zip) to the representable set.

(Third finding — pptx inference vs Bedrock — is a pre-existing backend
validation gap; the picker already excludes pptx for Bedrock. Tracked
separately.)

client/src/components/Chat/Input/Files/AttachFileMenu.tsx

@@ -19,12 +19,17 @@ import {
   Providers,
   EToolResources,
   EModelEndpoint,
-  isPermissiveMimeConfig,
+  getConfiguredMimeAccept,
+  bedrockDocumentMimeTypes,
   defaultAgentCapabilities,
   bedrockDocumentExtensions,
   isDocumentSupportedProvider,
 } from 'librechat-data-provider';
-import type { EndpointFileConfig, TConversation } from 'librechat-data-provider';
+import type {
+  TConversation,
+  EndpointFileConfig,
+  MimeUploadCapability,
+} from 'librechat-data-provider';
 import type { ExtendedFile, FileSetter } from '~/common';
 import {
   useAgentToolPermissions,
@@ -48,6 +53,22 @@ type FileUploadType =
   | 'image_document_extended'
   | 'image_document_video_audio';
 
+/** What each provider upload path can actually send, used to scope the picker filter to selectable files. */
+const fileTypeCapabilities: Record<FileUploadType, MimeUploadCapability> = {
+  image: { categories: ['image'] },
+  document: { categories: ['document'] },
+  image_document: { categories: ['image', 'document'] },
+  image_document_extended: {
+    categories: ['image', 'document'],
+    documentMimeTypes: bedrockDocumentMimeTypes,
+  },
+  /** Google/Vertex/OpenRouter media path: documents are limited to PDF (see isProviderAttachType). */
+  image_document_video_audio: {
+    categories: ['image', 'document', 'audio', 'video'],
+    documentMimeTypes: ['application/pdf'],
+  },
+};
+
 interface AttachFileMenuProps {
   agentId?: string | null;
   endpoint?: string | null;
@@ -120,11 +141,15 @@ const AttachFileMenu = ({
         return;
       }
       inputRef.current.value = '';
-      if (
-        fileType !== undefined &&
-        isPermissiveMimeConfig(endpointFileConfig?.supportedMimeTypes)
-      ) {
-        inputRef.current.accept = '';
+      const configuredAccept =
+        fileType !== undefined
+          ? getConfiguredMimeAccept(
+              endpointFileConfig?.supportedMimeTypes,
+              fileTypeCapabilities[fileType],
+            )
+          : undefined;
+      if (configuredAccept != null) {
+        inputRef.current.accept = configuredAccept;
       } else if (fileType === 'image') {
         inputRef.current.accept = 'image/*,.heif,.heic';
       } else if (fileType === 'document') {