Media: uploads stripped of metadata, attachments both ways, a remote media proxy

- /api/v1/media and /api/v2/media (and GET/PUT /api/v1/media/:id):
  images go through libvips (NetVips, its native build bundled):
  autorotated, every kind of metadata dropped (EXIF, GPS, XMP, IPTC,
  comments), capped at 4096 px, with a 640 px preview and a blurhash
  (own encoder, the reference algorithm); animated GIFs are re-encoded;
  video and audio are remuxed by ffmpeg with -map_metadata -1, never
  re-encoded, and a video gets a still preview. Files get random names
  under /var/lib/privapub/media, outside the web root deploys replace, and
  are served at /media/files with nosniff and a sandbox CSP.
- media_ids on create and edit (four at most, the persona's own, each used
  once); notes carry them as Document attachments with alt text, blurhash,
  focalPoint and size; inbound attachments were already kept.
- avatar and header uploads in update_credentials, cropped to 400x400 and
  1500x500, federated with Update{Person}.
- Remote media reaches clients only through /media/proxy/{hmac}/{url},
  fetched by the guarded client (no SVG, 40 MB cap) and cached outside the
  served root, trimmed to 5 GB; foreign avatars and headers use it too, so
  a client never contacts another server.
- MediaJanitor deletes uploads left unattached for a day.
- nginx accepts 100 MB bodies on the upload endpoints only (applied on Max).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub.Tests/Support/Peer.cs

@@ -19,6 +19,7 @@ namespace PrivaPub.Tests.Support
 		readonly WebApplication _app;
 		readonly ConcurrentDictionary<string, string> _documents = new();
 		readonly ConcurrentDictionary<string, (int Status, TimeSpan Delay)> _answers = new();
+		readonly ConcurrentDictionary<string, (byte[] Bytes, string ContentType)> _files = new();
 
 		public int Port { get; }
 		public string A => $"http://127.0.0.1:{Port}";
@@ -41,6 +42,12 @@ namespace PrivaPub.Tests.Support
 			{
 				peer.Requests.Enqueue(new(context.Request.Method, context.Request.Path, context.Request.Headers["Signature"].ToString()));
 				var key = context.Request.Path.Value;
+				if (peer._files.TryGetValue(key, out var file))
+				{
+					context.Response.ContentType = file.ContentType;
+					await context.Response.Body.WriteAsync(file.Bytes);
+					return;
+				}
 				if (peer._answers.TryGetValue(key, out var answer))
 				{
 					if (answer.Delay > TimeSpan.Zero)
@@ -63,6 +70,8 @@ namespace PrivaPub.Tests.Support
 
 		public void Serve(string path, string json) => _documents[path] = json;
 
+		public void ServeFile(string path, byte[] bytes, string contentType) => _files[path] = (bytes, contentType);
+
 		public void Answer(string path, int status, TimeSpan delay = default) => _answers[path] = (status, delay);
 
 		public static FederationHttp Http(IMemoryCache cache = default, IDomainBlocks blocks = default)