Media: uploads stripped of metadata, attachments both ways, a remote media proxy

- /api/v1/media and /api/v2/media (and GET/PUT /api/v1/media/:id):
  images go through libvips (NetVips, its native build bundled):
  autorotated, every kind of metadata dropped (EXIF, GPS, XMP, IPTC,
  comments), capped at 4096 px, with a 640 px preview and a blurhash
  (own encoder, the reference algorithm); animated GIFs are re-encoded;
  video and audio are remuxed by ffmpeg with -map_metadata -1, never
  re-encoded, and a video gets a still preview. Files get random names
  under /var/lib/privapub/media, outside the web root deploys replace, and
  are served at /media/files with nosniff and a sandbox CSP.
- media_ids on create and edit (four at most, the persona's own, each used
  once); notes carry them as Document attachments with alt text, blurhash,
  focalPoint and size; inbound attachments were already kept.
- avatar and header uploads in update_credentials, cropped to 400x400 and
  1500x500, federated with Update{Person}.
- Remote media reaches clients only through /media/proxy/{hmac}/{url},
  fetched by the guarded client (no SVG, 40 MB cap) and cached outside the
  served root, trimmed to 5 GB; foreign avatars and headers use it too, so
  a client never contacts another server.
- MediaJanitor deletes uploads left unattached for a day.
- nginx accepts 100 MB bodies on the upload endpoints only (applied on Max).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Api/Mastodon/Mappers/MastodonMapper.cs

@@ -2,6 +2,7 @@ using MongoDB.Entities;
 
 using PrivaPub.Api.Mastodon.Entities;
 using PrivaPub.Api.Mastodon.Infrastructure;
+using PrivaPub.Domain.Media;
 using PrivaPub.Federation.Actors;
 using PrivaPub.Federation.Rendering;
 using PrivaPub.Models.Federation;
@@ -21,13 +22,17 @@ namespace PrivaPub.Api.Mastodon.Mappers
 	{
 		readonly DbEntities _dbEntities;
 		readonly ILocalActorService _localActors;
+		readonly IMediaProxy _proxy;
 
-		public MastodonMapper(DbEntities dbEntities, ILocalActorService localActors)
+		public MastodonMapper(DbEntities dbEntities, ILocalActorService localActors, IMediaProxy proxy = default)
 		{
 			_dbEntities = dbEntities;
 			_localActors = localActors;
+			_proxy = proxy;
 		}
 
+		string Proxied(string url) => _proxy == default ? url : _proxy.Wrap(url);
+
 		string MissingAvatar => $"{_localActors.BaseAddress}/media/missing-avatar.png";
 		string MissingHeader => $"{_localActors.BaseAddress}/media/missing-header.png";
 
@@ -101,10 +106,10 @@ namespace PrivaPub.Api.Mastodon.Mappers
 			Note = foreign.Biography ?? string.Empty,
 			Url = foreign.Url ?? foreign.ActorURI,
 			Uri = foreign.ActorURI,
-			Avatar = foreign.PictureURL ?? MissingAvatar,
-			AvatarStatic = foreign.PictureURL ?? MissingAvatar,
-			Header = foreign.ThumbnailURL ?? MissingHeader,
-			HeaderStatic = foreign.ThumbnailURL ?? MissingHeader
+			Avatar = Proxied(foreign.PictureURL) ?? MissingAvatar,
+			AvatarStatic = Proxied(foreign.PictureURL) ?? MissingAvatar,
+			Header = Proxied(foreign.ThumbnailURL) ?? MissingHeader,
+			HeaderStatic = Proxied(foreign.ThumbnailURL) ?? MissingHeader
 		};
 
 		public async Task<Account> Account(string id, CancellationToken token) =>
@@ -244,9 +249,9 @@ namespace PrivaPub.Api.Mastodon.Mappers
 			return new StatusMention { Id = account.ID, Username = account.UserName, Acct = $"{account.UserName}@{account.Domain}", Url = account.Url ?? account.ActorURI };
 		}
 
-		static MediaAttachment Media(PostMedia media) => new()
+		MediaAttachment Media(PostMedia media) => new()
 		{
-			Id = media.Id.ToString("N"),
+			Id = media.AttachmentId ?? media.Id.ToString("N"),
 			Type = media.ContentType switch
 			{
 				{ } type when type.StartsWith("image/gif") => "gifv",
@@ -255,14 +260,18 @@ namespace PrivaPub.Api.Mastodon.Mappers
 				{ } type when type.StartsWith("audio/") => "audio",
 				_ => "unknown"
 			},
-			Url = media.URL ?? media.RemoteURL,
-			PreviewUrl = media.URL ?? media.RemoteURL,
+			Url = media.URL ?? Proxied(media.RemoteURL),
+			PreviewUrl = media.PreviewURL ?? media.URL ?? Proxied(media.RemoteURL),
 			RemoteUrl = media.RemoteURL,
 			Description = media.Description,
 			Blurhash = media.Blurhash,
-			Meta = media.Width.HasValue && media.Height.HasValue
-				? new { original = new { width = media.Width, height = media.Height, aspect = (double)media.Width / media.Height.Value } }
-				: default
+			Meta = new
+			{
+				original = media.Width.HasValue && media.Height > 0
+					? new { width = media.Width, height = media.Height, size = $"{media.Width}x{media.Height}", aspect = (double)media.Width / media.Height.Value }
+					: default,
+				focus = media.Focus is { Length: 2 } ? new { x = media.Focus[0], y = media.Focus[1] } : default
+			}
 		};
 	}
 }