feat(media): storage for images and audio in notes (M1)

- Table media (migration 5), files in $DATA_DIR/media/<docId>/.
- POST /documents/{id}/media (write access), POST .../media/fetch copies an
  external https image (SSRF-guarded, not in the demo), GET /media/{id}
  with range requests for readers of a note that shows the file.
- Format detected from the content (no SVG); own sandbox CSP on answers.
- Blocks point to files through their content (media:<id>), so the note
  sync needs no change; compaction removes files no block mentions any
  more after a day. Demo reset and demo start clear the folder.
- Limits MEDIA_MAX_IMAGE_MB, MEDIA_MAX_AUDIO_MB, MEDIA_QUOTA_MB,
  MEDIA_DEMO_MAX_MB.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/bodylimit.go

@@ -14,6 +14,8 @@ const defaultMaxBody = 2 << 20
 
 func (s *Server) bodyLimitFor(path string) int64 {
 	switch {
+	case strings.HasPrefix(path, "/api/v1/documents/") && strings.HasSuffix(path, "/media"):
+		return s.mediaUploadLimit()
 	case path == "/api/v1/voice/transcribe":
 		return int64(s.cfg.Speech.MaxUploadMB)<<20 + 1<<20
 	case strings.HasPrefix(path, "/api/v1/import/"):