feat: implement upload pipeline with compression and SSE

Backend:
- POST /api/v1/upload: multipart file upload with caption + hashtags
  - Validates file size against DB config limits (image/video separate)
  - Checks user ban status and event upload lock
  - Saves original to disk under {media_path}/originals/{slug}/
  - Tracks user total_upload_bytes for quota enforcement
  - Extracts hashtags from caption text and explicit CSV field
  - Upserts hashtags and links them to uploads
- PATCH /api/v1/upload/{id}: edit caption and hashtags (owner only)
- DELETE /api/v1/upload/{id}: soft-delete (owner only)
- GET /api/v1/stream: SSE endpoint with 30s keepalive
  - Broadcasts new-upload events to all connected clients
  - Uses tokio broadcast channel for fan-out

Services:
- CompressionWorker: Tokio semaphore-bounded (concurrency=2) background processor
  - Images: resize to 800px wide JPEG preview via image crate
  - PNG originals: lossless compression via oxipng
  - Videos: ffmpeg thumbnail extraction (1 frame at 1s, scaled to 800px)
  - Updates upload record with preview_path/thumbnail_path on completion

Models:
- Upload with full CRUD (create, find, update caption, soft delete, set paths)
- Hashtag with upsert, link/unlink, extract_hashtags() text parser
- UploadDto for API serialization with like/comment counts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/src/main.rs

@@ -1,5 +1,5 @@
 use anyhow::Result;
-use axum::routing::{delete, post};
+use axum::routing::{delete, get, patch, post};
 use axum::Router;
 use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
 
@@ -7,7 +7,9 @@ mod auth;
 mod config;
 mod db;
 mod error;
+mod handlers;
 mod models;
+mod services;
 mod state;
 
 use config::AppConfig;
@@ -28,14 +30,26 @@ async fn main() -> Result<()> {
     let pool = db::create_pool(&config.database_url).await?;
     let state = AppState::new(pool, config.clone());
 
+    // Ensure media directories exist
+    tokio::fs::create_dir_all(&config.media_path).await.ok();
+
     let api = Router::new()
+        // Auth
         .route("/api/v1/join", post(auth::handlers::join))
         .route("/api/v1/recover", post(auth::handlers::recover))
         .route("/api/v1/admin/login", post(auth::handlers::admin_login))
-        .route("/api/v1/session", delete(auth::handlers::logout));
+        .route("/api/v1/session", delete(auth::handlers::logout))
+        // Upload
+        .route("/api/v1/upload", post(handlers::upload::upload))
+        .route(
+            "/api/v1/upload/{id}",
+            patch(handlers::upload::edit_upload).delete(handlers::upload::delete_upload),
+        )
+        // SSE
+        .route("/api/v1/stream", get(handlers::sse::stream));
 
     let router = Router::new()
-        .route("/health", axum::routing::get(|| async { "ok" }))
+        .route("/health", get(|| async { "ok" }))
         .merge(api)
         .with_state(state);