Turn the image library into a file library, with a per-blog upload limit

Bloggers want to attach PDFs, archives, audio and other files to posts,
not only images. The Images tab becomes Files: any type is accepted,
listed by kind with search, paging, rename and multi-file upload, and the
editor's paste/drop/"Insert file" takes anything (images are shown,
everything else becomes a link). The default limit goes from 5 to 10 MB
and the superadmin can override it per blog from /admin/.

Files stay in Postgres so one pg_dump is still the whole blog. The bytea
column is STORAGE EXTERNAL and /media streams it in substring() slices,
so serving never holds a whole file in memory whatever limit a blog gets.

Serving any type on the root domain, which carries the session cookie,
needs a policy: uploads are typed by sniffing (the extension may only
refine a generic sniff to an allowlisted type) and only images, PDF,
plain text, audio and video render inline; HTML, SVG, XML, scripts,
archives and binaries always go out as application/octet-stream with
Content-Disposition: attachment.

The body cap moves out of requireAuth into guardPOST, which runs after
withBlog has resolved the blog and so knows its limit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A

1 files changed, 2 insertions, 2 deletions

diff --git a/internal/markdown/render_test.go b/internal/markdown/render_test.go
index 7240afc..6bc7e48 100644
--- a/internal/markdown/render_test.go
+++ b/internal/markdown/render_test.go
@@ -6,13 +6,13 @@ import (
 )
 
 func TestRenderSanitizes(t *testing.T) {
-	out := Render("# Hi\n\n**bold** <script>alert(1)</script> <a href=\"javascript:alert(1)\">x</a> <img src=\"/media/abc\" onerror=\"x()\">")
+	out := Render("# Hi\n\n**bold** <script>alert(1)</script> <a href=\"javascript:alert(1)\">x</a> <img src=\"/media/abc\" onerror=\"x()\"> [notes.pdf](/media/abc)")
 	for _, bad := range []string{"<script", "javascript:", "onerror"} {
 		if strings.Contains(out, bad) {
 			t.Errorf("output contains %q: %s", bad, out)
 		}
 	}
-	for _, good := range []string{"<h1", "<strong>bold</strong>", `<img src="/media/abc"`} {
+	for _, good := range []string{"<h1", "<strong>bold</strong>", `<img src="/media/abc"`, `<a href="/media/abc"`} {
 		if !strings.Contains(out, good) {
 			t.Errorf("output missing %q: %s", good, out)
 		}