feat: multipart manga + chapter uploads with magic-byte MIME sniff

POST /api/v1/mangas and POST /api/v1/mangas/{id}/chapters now accept
multipart/form-data, gated by CurrentUser:

- /mangas: required `metadata` part (NewManga JSON) + optional `cover`
  image part.
- /mangas/{id}/chapters: required `metadata` (NewChapter JSON) + one or
  more `page` parts ordered by arrival. Returns 404 if the parent manga
  doesn't exist, 409 on duplicate (manga_id, number).

MIME is sniffed via the `infer` crate (magic bytes), not the
client-supplied filename or Content-Type. Whitelist:
jpeg / png / webp / gif / avif. Anything else → 415
unsupported_media_type. The stored key's extension is derived from the
sniffed type so a "page1.png" that's actually a JPEG lands as `.jpg`.

Size cap is two-layer:
- Request body cap (config.max_request_bytes, default 200 MiB) enforced
  by axum's DefaultBodyLimit before the handler sees the request.
- Per-image-part cap (config.max_file_bytes, default 20 MiB) enforced
  after reading the part, so a single oversized image can't pass even
  if the total request fits.

Storage keys follow the layout documented in CLAUDE.md:
- mangas/{manga_id}/cover.{ext}
- mangas/{manga_id}/chapters/{chapter_id}/pages/{nnnn}.{ext} (1-indexed).

AppError grows PayloadTooLarge/UnsupportedMediaType/ValidationFailed
(413 / 415 / 422). ValidationFailed carries a `details` JSON object the
client can use to highlight bad fields (e.g. {"title":"required"}).
Top-level matching in code() stays exhaustive.

Backend coverage in tests/api_uploads.rs (10 cases):
- create_manga_with_cover_stores_image — file is reachable via
  /api/v1/files/{key} with the right Content-Type.
- create_manga_without_cover_leaves_path_null.
- create_manga_rejects_non_image_cover_with_415 — PDF claimed as png.
- create_manga_rejects_oversized_cover_with_413.
- create_chapter_with_pages_stores_each — extension derived from
  sniffed MIME, files reachable in arrival order.
- create_chapter_rejects_when_no_pages_with_422 — details.page set.
- create_chapter_rejects_renamed_non_image_page → 415.
- create_chapter_returns_409_on_duplicate_number.
- create_chapter_requires_authentication → 401.
- create_chapter_under_unknown_manga_is_404.

Existing tests/api_mangas.rs is migrated to multipart; the create
response is now 201 Created. tests/common::MultipartBuilder builds the
body by hand so the test crate stays free of HTTP-client deps.

Frontend lib/api/mangas.ts: createManga now sends FormData (metadata +
optional cover Blob). Browser fills in the boundary header automatically.
Vitest asserts the FormData structure via FileReader (jsdom doesn't
implement Blob.text()).

E2E tests wait for the post-hydration nav-login link before
interacting with the login form, fixing a flake where pre-hydration
clicks would submit via the browser default and bypass our handler.

Lockstep version bump to 0.5.0.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/error.rs

@@ -17,6 +17,17 @@ pub enum AppError {
     Forbidden,
     #[error("conflict: {0}")]
     Conflict(String),
+    #[error("payload too large: {0}")]
+    PayloadTooLarge(String),
+    #[error("unsupported media type: {0}")]
+    UnsupportedMediaType(String),
+    /// Semantic per-field validation failure. `details` is rendered into the
+    /// envelope so the client can highlight the bad field(s).
+    #[error("validation failed")]
+    ValidationFailed {
+        message: String,
+        details: serde_json::Value,
+    },
     #[error(transparent)]
     Database(#[from] sqlx::Error),
     #[error(transparent)]
@@ -38,6 +49,9 @@ impl AppError {
             AppError::Unauthenticated => "unauthenticated",
             AppError::Forbidden => "forbidden",
             AppError::Conflict(_) => "conflict",
+            AppError::PayloadTooLarge(_) => "payload_too_large",
+            AppError::UnsupportedMediaType(_) => "unsupported_media_type",
+            AppError::ValidationFailed { .. } => "validation_failed",
             AppError::Database(sqlx::Error::RowNotFound) => "not_found",
             AppError::Database(_) => "internal_error",
             AppError::Storage(StorageError::NotFound) => "not_found",
@@ -51,27 +65,49 @@ impl AppError {
 impl IntoResponse for AppError {
     fn into_response(self) -> Response {
         let code = self.code();
-        let (status, message) = match &self {
-            AppError::NotFound => (StatusCode::NOT_FOUND, "not found".to_string()),
-            AppError::InvalidInput(msg) => (StatusCode::BAD_REQUEST, msg.clone()),
-            AppError::Unauthenticated => (StatusCode::UNAUTHORIZED, "unauthenticated".to_string()),
-            AppError::Forbidden => (StatusCode::FORBIDDEN, "forbidden".to_string()),
-            AppError::Conflict(msg) => (StatusCode::CONFLICT, msg.clone()),
+        let (status, message, details) = match &self {
+            AppError::NotFound => (StatusCode::NOT_FOUND, "not found".to_string(), None),
+            AppError::InvalidInput(msg) => (StatusCode::BAD_REQUEST, msg.clone(), None),
+            AppError::Unauthenticated => {
+                (StatusCode::UNAUTHORIZED, "unauthenticated".to_string(), None)
+            }
+            AppError::Forbidden => (StatusCode::FORBIDDEN, "forbidden".to_string(), None),
+            AppError::Conflict(msg) => (StatusCode::CONFLICT, msg.clone(), None),
+            AppError::PayloadTooLarge(msg) => {
+                (StatusCode::PAYLOAD_TOO_LARGE, msg.clone(), None)
+            }
+            AppError::UnsupportedMediaType(msg) => {
+                (StatusCode::UNSUPPORTED_MEDIA_TYPE, msg.clone(), None)
+            }
+            AppError::ValidationFailed { message, details } => (
+                StatusCode::UNPROCESSABLE_ENTITY,
+                message.clone(),
+                Some(details.clone()),
+            ),
             AppError::Database(sqlx::Error::RowNotFound) => {
-                (StatusCode::NOT_FOUND, "not found".to_string())
+                (StatusCode::NOT_FOUND, "not found".to_string(), None)
             }
             AppError::Storage(StorageError::NotFound) => {
-                (StatusCode::NOT_FOUND, "not found".to_string())
-            }
-            AppError::Storage(StorageError::BadKey) => {
-                (StatusCode::BAD_REQUEST, "invalid file key".to_string())
+                (StatusCode::NOT_FOUND, "not found".to_string(), None)
             }
+            AppError::Storage(StorageError::BadKey) => (
+                StatusCode::BAD_REQUEST,
+                "invalid file key".to_string(),
+                None,
+            ),
             AppError::Database(_) | AppError::Storage(_) | AppError::Other(_) => {
                 tracing::error!(error = ?self, "internal error");
-                (StatusCode::INTERNAL_SERVER_ERROR, "internal error".to_string())
+                (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    "internal error".to_string(),
+                    None,
+                )
             }
         };
-        let body = json!({ "error": { "code": code, "message": message } });
+        let body = match details {
+            Some(d) => json!({ "error": { "code": code, "message": message, "details": d } }),
+            None => json!({ "error": { "code": code, "message": message } }),
+        };
         (status, Json(body)).into_response()
     }
 }
@@ -87,6 +123,19 @@ mod tests {
         assert_eq!(AppError::Unauthenticated.code(), "unauthenticated");
         assert_eq!(AppError::Forbidden.code(), "forbidden");
         assert_eq!(AppError::Conflict("x".into()).code(), "conflict");
+        assert_eq!(AppError::PayloadTooLarge("x".into()).code(), "payload_too_large");
+        assert_eq!(
+            AppError::UnsupportedMediaType("x".into()).code(),
+            "unsupported_media_type"
+        );
+        assert_eq!(
+            AppError::ValidationFailed {
+                message: "x".into(),
+                details: json!({}),
+            }
+            .code(),
+            "validation_failed"
+        );
         assert_eq!(AppError::Storage(StorageError::BadKey).code(), "bad_file_key");
         assert_eq!(AppError::Storage(StorageError::NotFound).code(), "not_found");
         assert_eq!(AppError::Database(sqlx::Error::RowNotFound).code(), "not_found");