feat(media): authenticated signed media gateway (C1, C2-sink, C3, H2, H10)

Replaces the DB-blind `/media` ServeDir with a signed, DB-aware gateway at
`GET /media/{kind}/{id}`. Every media byte now flows through an HMAC-SHA256
signature check (minted into feed/upload DTOs for authenticated members; <img>
can't carry a Bearer header) plus a DB lookup:

- C1: export ZIP/HTML have no upload row, so they are unreachable by path —
  download stays behind the authenticated /export endpoints.
- C2 (sink): responses carry X-Content-Type-Options: nosniff and a locked-down
  CSP (default-src 'none'; sandbox), neutralizing any active content.
- C3 / H2: find_by_id filters deleted_at and the handler rejects ban-hidden
  uploaders, so deleted and moderated artifacts 404 — and the unauthenticated
  get_original alias (the H2 hole) is removed entirely.
- H10: delete paths (owner + host) now unlink original/preview/thumbnail after
  commit; soft_delete returns the paths; an hourly reaper reclaims disk for
  rows soft-deleted past a 1-day grace and hard-deletes them (FKs cascade).

Signed URLs are bucketed to a 1h window so they stay stable across feed polls
(browser cache hits) while expiring within 24h. media_token sign/verify has a
unit test (roundtrip + tamper + expiry).

Frontend: FeedUpload/pickMediaUrl now use the backend-provided signed
original_url; no client constructs a media path anymore.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/src/handlers/host.rs

@@ -324,24 +324,21 @@ pub async fn host_delete_upload(
     RequireHost(auth): RequireHost,
     Path(upload_id): Path<Uuid>,
 ) -> Result<StatusCode, AppError> {
-    let upload = Upload::find_by_id_and_event(&state.pool, upload_id, auth.event_id)
+    let paths = Upload::soft_delete_in_event(&state.pool, upload_id, auth.event_id)
         .await?
         .ok_or_else(|| AppError::NotFound("Upload nicht gefunden.".into()))?;
 
-    let deleted = Upload::soft_delete_in_event(&state.pool, upload_id, auth.event_id).await?;
-    if !deleted {
-        return Err(AppError::NotFound("Upload nicht gefunden.".into()));
-    }
+    crate::services::media_fs::unlink_media(&state.config.media_path, &paths).await;
 
     let _ = state.sse_tx.send(SseEvent::new(
         "upload-deleted",
-        serde_json::json!({ "upload_id": upload.id }).to_string(),
+        serde_json::json!({ "upload_id": upload_id }).to_string(),
     ));
 
     tracing::info!(
         actor_user_id = %auth.user_id,
         event_id = %auth.event_id,
-        upload_id = %upload.id,
+        upload_id = %upload_id,
         "host: host_delete_upload"
     );