Media: uploads stripped of metadata, attachments both ways, a remote media proxy

- /api/v1/media and /api/v2/media (and GET/PUT /api/v1/media/:id):
  images go through libvips (NetVips, its native build bundled):
  autorotated, every kind of metadata dropped (EXIF, GPS, XMP, IPTC,
  comments), capped at 4096 px, with a 640 px preview and a blurhash
  (own encoder, the reference algorithm); animated GIFs are re-encoded;
  video and audio are remuxed by ffmpeg with -map_metadata -1, never
  re-encoded, and a video gets a still preview. Files get random names
  under /var/lib/privapub/media, outside the web root deploys replace, and
  are served at /media/files with nosniff and a sandbox CSP.
- media_ids on create and edit (four at most, the persona's own, each used
  once); notes carry them as Document attachments with alt text, blurhash,
  focalPoint and size; inbound attachments were already kept.
- avatar and header uploads in update_credentials, cropped to 400x400 and
  1500x500, federated with Update{Person}.
- Remote media reaches clients only through /media/proxy/{hmac}/{url},
  fetched by the guarded client (no SVG, 40 MB cap) and cached outside the
  served root, trimmed to 5 GB; foreign avatars and headers use it too, so
  a client never contacts another server.
- MediaJanitor deletes uploads left unattached for a day.
- nginx accepts 100 MB bodies on the upload endpoints only (applied on Max).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub.Tests/Support/Harness.cs

@@ -5,6 +5,7 @@ using Microsoft.Extensions.Logging.Abstractions;
 using MongoDB.Entities;
 
 using PrivaPub.Domain.Content;
+using PrivaPub.Domain.Media;
 using PrivaPub.Domain.Relationships;
 using PrivaPub.Domain.Social;
 using PrivaPub.Domain.Statuses;
@@ -58,7 +59,9 @@ namespace PrivaPub.Tests.Support
 			Follows = new FollowService(Db, Local, Remote, Delivery, new KeyLocalizer<GenericRes>(), NullLogger<FollowService>.Instance);
 			Content = new ContentRenderer(Local, Remote);
 			Outbox = new OutboxPublisher(Db, Local, Delivery);
-			Statuses = new StatusService(Db, Local, Remote, Delivery, Content, Outbox, Fanout);
+			Media = new MediaService(new StaticOptions<MediaOptions>(new MediaOptions { Root = Path.Combine(Path.GetTempPath(), $"privapub-media-{Guid.NewGuid():N}") }),
+				Local, default, NullLogger<MediaService>.Instance);
+			Statuses = new StatusService(Db, Local, Remote, Delivery, Content, Outbox, Fanout, Media);
 			Posts = new PostsService(Db, Local, Statuses, new KeyLocalizer<GenericRes>(), NullLogger<PostsService>.Instance);
 			Timelines = new TimelineService(Db, new KeyLocalizer<GenericRes>());
 			Relationships = new RelationshipService(Db, Follows, Delivery);
@@ -78,6 +81,7 @@ namespace PrivaPub.Tests.Support
 		public OutboxPublisher Outbox { get; }
 		public PostsService Posts { get; }
 		public StatusService Statuses { get; }
+		public MediaService Media { get; }
 		public Fanout Fanout { get; }
 		public RemotePosts RemotePosts { get; }
 		public TimelineService Timelines { get; }

PrivaPub.Tests/Support/Peer.cs

@@ -19,6 +19,7 @@ namespace PrivaPub.Tests.Support
 		readonly WebApplication _app;
 		readonly ConcurrentDictionary<string, string> _documents = new();
 		readonly ConcurrentDictionary<string, (int Status, TimeSpan Delay)> _answers = new();
+		readonly ConcurrentDictionary<string, (byte[] Bytes, string ContentType)> _files = new();
 
 		public int Port { get; }
 		public string A => $"http://127.0.0.1:{Port}";
@@ -41,6 +42,12 @@ namespace PrivaPub.Tests.Support
 			{
 				peer.Requests.Enqueue(new(context.Request.Method, context.Request.Path, context.Request.Headers["Signature"].ToString()));
 				var key = context.Request.Path.Value;
+				if (peer._files.TryGetValue(key, out var file))
+				{
+					context.Response.ContentType = file.ContentType;
+					await context.Response.Body.WriteAsync(file.Bytes);
+					return;
+				}
 				if (peer._answers.TryGetValue(key, out var answer))
 				{
 					if (answer.Delay > TimeSpan.Zero)
@@ -63,6 +70,8 @@ namespace PrivaPub.Tests.Support
 
 		public void Serve(string path, string json) => _documents[path] = json;
 
+		public void ServeFile(string path, byte[] bytes, string contentType) => _files[path] = (bytes, contentType);
+
 		public void Answer(string path, int status, TimeSpan delay = default) => _answers[path] = (status, delay);
 
 		public static FederationHttp Http(IMemoryCache cache = default, IDomainBlocks blocks = default)