Turn the image library into a file library, with a per-blog upload limit

Bloggers want to attach PDFs, archives, audio and other files to posts,
not only images. The Images tab becomes Files: any type is accepted,
listed by kind with search, paging, rename and multi-file upload, and the
editor's paste/drop/"Insert file" takes anything (images are shown,
everything else becomes a link). The default limit goes from 5 to 10 MB
and the superadmin can override it per blog from /admin/.

Files stay in Postgres so one pg_dump is still the whole blog. The bytea
column is STORAGE EXTERNAL and /media streams it in substring() slices,
so serving never holds a whole file in memory whatever limit a blog gets.

Serving any type on the root domain, which carries the session cookie,
needs a policy: uploads are typed by sniffing (the extension may only
refine a generic sniff to an allowlisted type) and only images, PDF,
plain text, audio and video render inline; HTML, SVG, XML, scripts,
archives and binaries always go out as application/octet-stream with
Content-Disposition: attachment.

The body cap moves out of requireAuth into guardPOST, which runs after
withBlog has resolved the blog and so knows its limit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A

2 files changed, 31 insertions, 0 deletions

diff --git a/internal/db/migrations/blog/00003_files.sql b/internal/db/migrations/blog/00003_files.sql
new file mode 100644
index 0000000..2ed8820
--- /dev/null
+++ b/internal/db/migrations/blog/00003_files.sql
@@ -0,0 +1,25 @@
+-- +goose Up
+-- The image library becomes a file library: any type is accepted and files are
+-- served in slices (substring), so a download never loads the whole blob.
+ALTER TABLE images RENAME TO files;
+ALTER TABLE files RENAME CONSTRAINT images_pkey TO files_pkey;
+ALTER INDEX images_created RENAME TO files_created;
+-- Out of line and uncompressed, so substring() reads only the chunks it needs
+-- (uploads are mostly jpeg/zip/pdf, which pglz would not shrink anyway).
+ALTER TABLE files ALTER COLUMN data SET STORAGE EXTERNAL;
+ALTER TABLE files
+    ADD COLUMN kind text NOT NULL DEFAULT 'image'
+        CHECK (kind IN ('image', 'document', 'audio', 'video', 'archive', 'other')),
+    ALTER COLUMN size TYPE bigint;
+ALTER TABLE files ALTER COLUMN kind DROP DEFAULT; -- everything so far was an image
+CREATE INDEX files_kind_created ON files (kind, created_at DESC);
+-- SET STORAGE only applies to values written from now on; re-store the existing
+-- rows (`data = data` would keep the old TOAST pointer, the concatenation does not).
+UPDATE files SET data = data || ''::bytea;
+
+-- +goose Down
+DROP INDEX files_kind_created;
+ALTER TABLE files DROP COLUMN kind, ALTER COLUMN size TYPE integer, ALTER COLUMN data SET STORAGE EXTENDED;
+ALTER INDEX files_created RENAME TO images_created;
+ALTER TABLE files RENAME CONSTRAINT files_pkey TO images_pkey;
+ALTER TABLE files RENAME TO images;
diff --git a/internal/db/migrations/control/00002_upload_limit.sql b/internal/db/migrations/control/00002_upload_limit.sql
new file mode 100644
index 0000000..9a1ec90
--- /dev/null
+++ b/internal/db/migrations/control/00002_upload_limit.sql
@@ -0,0 +1,6 @@
+-- +goose Up
+-- Per-blog upload limit set by the superadmin; NULL means the server default (MAX_UPLOAD_MB).
+ALTER TABLE blogs ADD COLUMN max_upload_bytes bigint CHECK (max_upload_bytes IS NULL OR max_upload_bytes > 0);
+
+-- +goose Down
+ALTER TABLE blogs DROP COLUMN max_upload_bytes;