// GET /cms/media/:id — serve the image as REAL binary bytes (public).
// Since the platform fix (F-026), a response with a `body_base64` field returns
// raw bytes with a script-set Content-Type, so <img src="/cms/media/:id"> works
// directly (no more base64 data-URL workaround).
let id = ctx.request.params.id;
let media = files::collection("media");
let meta = media.head(id);
if meta == () { return #{ statusCode: 404, body: #{ error: "not found" } }; }
let bytes = media.get(id);
if bytes == () { return #{ statusCode: 404, body: #{ error: "not found" } }; }
#{
    statusCode: 200,
    headers: #{
        "content-type": meta.content_type,
        "cache-control": "public, max-age=3600",
    },
    body_base64: base64::encode(bytes),
}