feat(media): storage for images and audio in notes (M1)

- Table media (migration 5), files in $DATA_DIR/media/<docId>/.
- POST /documents/{id}/media (write access), POST .../media/fetch copies an
  external https image (SSRF-guarded, not in the demo), GET /media/{id}
  with range requests for readers of a note that shows the file.
- Format detected from the content (no SVG); own sandbox CSP on answers.
- Blocks point to files through their content (media:<id>), so the note
  sync needs no change; compaction removes files no block mentions any
  more after a day. Demo reset and demo start clear the folder.
- Limits MEDIA_MAX_IMAGE_MB, MEDIA_MAX_AUDIO_MB, MEDIA_QUOTA_MB,
  MEDIA_DEMO_MAX_MB.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/server.go

@@ -132,6 +132,9 @@ func (s *Server) Router() http.Handler {
 		r.Post("/api/v1/events/rooms", s.handleSSERooms)
 		r.Post("/api/v1/auth/stream-ticket", s.handleStreamTicket)
 		r.Post("/api/v1/voice/transcribe", s.handleVoiceTranscribe)
+		r.Post("/api/v1/documents/{id}/media", s.handleUploadMedia)
+		r.Post("/api/v1/documents/{id}/media/fetch", s.notInDemo(s.handleFetchMedia))
+		r.Get("/api/v1/media/{id}", s.handleGetMedia)
 		r.Get("/api/v1/auth/sessions", s.handleListSessions)
 		r.Delete("/api/v1/auth/sessions/{id}", s.notInDemo(s.handleEndSession))
 		r.Post("/api/v1/auth/logout", s.handleLogout)