docs: add base64 payload finding to SESSION-LOG and CLAUDE.md rules

CLAUDE.md

@@ -204,6 +204,10 @@ git push origin main
 - **ALWAYS** use `storage.exportAll()` (namespaced) or `storage.export(namespace)` (service-level) to batch-load
 - Filter items client-side after a single fetch: `for (const [key, value] of Object.entries(all)) { ... }`
 - After mutations (add/update), either do optimistic local state update or a single `refresh()` — never both
+- **NEVER store large binary data (base64 files) inside entity JSON** — this makes list loading transfer tens of MB
+- For modules with attachments: use `exportAll({ lightweight: true })` for listing, `storage.get()` for single-entry full load
+- The API `?lightweight=true` parameter strips `data`/`fileData` strings >1KB from JSON values server-side
+- Future: move file data to MinIO; only store metadata (name, size, type, url) in the entity JSON
 
 ### Module Development Pattern