fix(e2e): track the test fixtures the suite reads

`.gitignore` carried an unanchored `media/`, commented "Media uploads (mounted volume in
production)". Production media lives in the `media_data` Docker volume and never
appears in the working tree, so that rule guarded nothing real — but unanchored it
matches a directory of that name at ANY depth, and the only one in the repo is
`e2e/fixtures/media/`.

Its entire practical effect was to keep every E2E fixture untracked. A fresh clone got
the specs and none of the images or videos they read, and
`.github/workflows/e2e.yml` does a plain `actions/checkout` and generates nothing — so
the committed CI job could not have run the upload, video, EXIF, quota, oversized-image
or export suites at all. It only ever looked green locally, where the fixtures survive
as untracked leftovers from whoever first created them.

The `origin` remote is git.mc02.dev rather than GitHub, so those workflows have most
likely never executed against this repo, which is consistent with nobody noticing. That
also makes this a live blocker for the standing "rotate the token and push" item: the
first time CI runs, it fails on ENOENT in a way that looks like a broken suite rather
than a missing file.

Anchors the pattern to `/media/` and commits the six fixtures (672 KB total). Verified
`e2e/fixtures/media` is the ONLY directory the old pattern matched, so nothing else
changes visibility.

Found while adding `sample-5s.mp4` for the video-poster work: the new fixture would
have been invisible to every other machine, which is how the existing ones got here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -13,8 +13,16 @@ frontend/build/
 frontend/export-viewer/node_modules/
 frontend/export-viewer/.svelte-kit/
 
-# Media uploads (mounted volume in production)
+# Media uploads. In production these live in the `media_data` DOCKER VOLUME, never in the
-media/
+# working tree — so this pattern is anchored to the repo root and exists only for a local
+# bind-mount experiment.
+#
+# It used to read `media/`, unanchored, which matches a directory of that name at ANY depth.
+# The only one in the repo is `e2e/fixtures/media/`, so the rule's entire practical effect was
+# to keep every E2E fixture untracked: a fresh clone got the specs and none of the images or
+# videos they read. `.github/workflows/e2e.yml` does a plain checkout and generates nothing, so
+# the committed CI job could not have run the upload, video or export suites at all.
+/media/
 
 # Playwright E2E suite — runtime artifacts (the suite itself is committed)
 e2e/node_modules/