A file lives exactly as long as something holds it

Deleting a post, editing media out, replacing an avatar or a header, and removing a whole root deleted no file: every
one stayed on disk and publicly served from /media/files with a year-long immutable cache, its row orphaned. Now every
upload is a row, profile pictures too (Kind avatar or header, ProfileOfAvatarId), and each of those acts trashes what
it held, as does an upload never posted for a day and a dropped scheduled post. A trashed row is marked in one
conditional update (an upload attached meanwhile is left alone), its files move into media-trash, beside the media
root and outside what /media/files serves, and the janitor deletes them a day later. Nothing is deleted for looking
unused.

Along the way: a profile picture that isn't an image, or can't be read, answers 422 instead of being silently ignored
with a 200; a removed root's scheduled posts are dropped, so nothing of it publishes later; media rows get indexes
(they had none), and the janitor's first pass comes five minutes after boot instead of an hour.

`PrivaPub admin media audit [--fix]` compares the disk with the database. With --fix (as www-data) it gives the
pictures personas show today a row, and trashes media of deleted posts or personas, rows whose files are missing, and
files nothing holds: the leftovers of every deletion until now. MediaLifecycleTests covers each act, that the trash is
never served, and the audit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

PrivaPub/Api/Mastodon/Controllers/AccountsController.cs

@@ -51,13 +51,28 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		public async Task<IActionResult> UpdateCredentials([FromServices] IMediaService media, CancellationToken token)
 		{
 			var avatar = await _dbEntities.Avatars.MatchID(Me.Id).ExecuteFirstAsync(token);
+			// a new picture is a row of its own; the one it replaces goes to the trash once the profile is saved
+			var replaced = new List<Models.Media.MediaAttachment>();
 			if (Request.HasFormContentType)
 			{
 				var form = await Request.ReadFormAsync(token);
-				if (form.Files["avatar"] is { } picture && await media.ProfileImage(picture, 400, 400, token) is { } pictureUrl)
-					avatar.PictureURL = pictureUrl;
-				if (form.Files["header"] is { } header && await media.ProfileImage(header, 1500, 500, token) is { } headerUrl)
-					avatar.ThumbnailURL = headerUrl;
+				foreach (var (field, kind, width, height) in new[] { ("avatar", "avatar", 400, 400), ("header", "header", 1500, 500) })
+				{
+					if (form.Files[field] is not { } file)
+						continue;
+					var outcome = await media.ProfileImage(avatar.ID, kind, file, width, height, token);
+					if (!outcome.Ok)
+					{
+						foreach (var made in replaced)
+							await media.Trash(m => m.ID == made.ID, "profile not saved", token);
+						return Error(outcome.Status, outcome.Error);
+					}
+					replaced.Add(outcome.Attachment);
+					if (kind == "avatar")
+						avatar.PictureURL = media.Url(outcome.Attachment.FilePath);
+					else
+						avatar.ThumbnailURL = media.Url(outcome.Attachment.FilePath);
+				}
 			}
 			if (Params.Has("display_name"))
 				avatar.Name = Params.Get("display_name")?.Trim();
@@ -98,6 +113,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				avatar.Fields = fields;
 			avatar.UpdatedAt = DateTime.UtcNow;
 			await DB.Default.SaveAsync(avatar, token);
+			foreach (var made in replaced)
+				await media.Trash(m => m.ProfileOfAvatarId == avatar.ID && m.Kind == made.Kind && m.ID != made.ID, "replaced", token);
 
 			var actor = _localActors.FromAvatar(avatar);
 			await _outbox.PublishProfile(actor, token);