feat(media): storage for images and audio in notes (M1)

- Table media (migration 5), files in $DATA_DIR/media/<docId>/.
- POST /documents/{id}/media (write access), POST .../media/fetch copies an
  external https image (SSRF-guarded, not in the demo), GET /media/{id}
  with range requests for readers of a note that shows the file.
- Format detected from the content (no SVG); own sandbox CSP on answers.
- Blocks point to files through their content (media:<id>), so the note
  sync needs no change; compaction removes files no block mentions any
  more after a day. Demo reset and demo start clear the folder.
- Limits MEDIA_MAX_IMAGE_MB, MEDIA_MAX_AUDIO_MB, MEDIA_QUOTA_MB,
  MEDIA_DEMO_MAX_MB.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/demo.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"log/slog"
 	"net/http"
+	"os"
 	"strings"
 	"sync"
 	"time"
@@ -59,6 +60,8 @@ func (s *Server) setDemoNextReset(t time.Time) {
 func (s *Server) resetDemo() {
 	s.demo.gate.Lock()
 	err := s.store.ResetAndSeedDemo()
+	// Uploaded images and recordings belong to the old state; their rows are gone with the tables
+	_ = os.RemoveAll(s.mediaRoot())
 	s.demo.gate.Unlock()
 	if err != nil {
 		slog.Error("Demo-Reset fehlgeschlagen", "error", err)