Quick answer:
The 280 limit does not include user handles or attachment URLs
There is no limit to the full_text field.
Here is some language on our developer support site that addresses this post:
Tweet object changes
The following things change within Tweet payloads:
The displayed text in a Tweet does not exceed the Tweet text length limit, but - when usernames or attachment URLs are included at the appropriate points in the Tweet - the text content of the overall Tweet JSON object will be able to exceed the Tweet text length limit. Developers must avoid hard-coding length assumptions into their applications.
The text shall be logically divided into three regions:
A hidden prefix region that may contain one or more space-separated @mentions which shall not be rendered as part of the display text, but must instead be rendered as metadata.
A display text region, which matches the Tweet text length limit.
A hidden suffix region that may contain one attachment URL which shall not be rendered as part of the display text, but must instead be rendered as metadata. This region is limited to containing a single URL entity that identifies an attachment resource: currently, one to four photos, a GIF, video, poll, Quote Tweet, or DM deep link.
Here is a link to this article: https://developer.twitter.com/en/docs/tweets/tweet-updates