Turn the image library into a file library, with a per-blog upload limit

Bloggers want to attach PDFs, archives, audio and other files to posts,
not only images. The Images tab becomes Files: any type is accepted,
listed by kind with search, paging, rename and multi-file upload, and the
editor's paste/drop/"Insert file" takes anything (images are shown,
everything else becomes a link). The default limit goes from 5 to 10 MB
and the superadmin can override it per blog from /admin/.

Files stay in Postgres so one pg_dump is still the whole blog. The bytea
column is STORAGE EXTERNAL and /media streams it in substring() slices,
so serving never holds a whole file in memory whatever limit a blog gets.

Serving any type on the root domain, which carries the session cookie,
needs a policy: uploads are typed by sniffing (the extension may only
refine a generic sniff to an allowlisted type) and only images, PDF,
plain text, audio and video render inline; HTML, SVG, XML, scripts,
archives and binaries always go out as application/octet-stream with
Content-Disposition: attachment.

The body cap moves out of requireAuth into guardPOST, which runs after
withBlog has resolved the blog and so knows its limit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A

1 files changed, 6 insertions, 3 deletions

diff --git a/internal/web/templates.go b/internal/web/templates.go
index 7f71304..c2f9847 100644
--- a/internal/web/templates.go
+++ b/internal/web/templates.go
@@ -110,9 +110,12 @@ var funcs = template.FuncMap{
 	"rfc":  func(t time.Time) string { return t.Format(time.RFC1123Z) },
 	"html": func(s string) template.HTML { return template.HTML(s) },
 	"css":  func(s string) template.CSS { return template.CSS(s) },
-	"kb":   func(n int) string { return fmt.Sprintf("%.0f KB", float64(n)/1024) },
-	"add":  func(a, b int) int { return a + b },
-	"sub":  func(a, b int) int { return a - b },
+	"size": humanSize,
+	"mb":   func(n int64) int64 { return n >> 20 },
+	// filemd is the Markdown line for a library file, what "Insert file" writes
+	"filemd": fileMarkdown,
+	"add":    func(a, b int) int { return a + b },
+	"sub":    func(a, b int) int { return a - b },
 	"deref": func(p *string) string {
 		if p == nil {
 			return ""