A file lives exactly as long as something holds it

Deleting a post, editing media out, replacing an avatar or a header, and removing a whole root deleted no file: every
one stayed on disk and publicly served from /media/files with a year-long immutable cache, its row orphaned. Now every
upload is a row, profile pictures too (Kind avatar or header, ProfileOfAvatarId), and each of those acts trashes what
it held, as does an upload never posted for a day and a dropped scheduled post. A trashed row is marked in one
conditional update (an upload attached meanwhile is left alone), its files move into media-trash, beside the media
root and outside what /media/files serves, and the janitor deletes them a day later. Nothing is deleted for looking
unused.

Along the way: a profile picture that isn't an image, or can't be read, answers 422 instead of being silently ignored
with a 200; a removed root's scheduled posts are dropped, so nothing of it publishes later; media rows get indexes
(they had none), and the janitor's first pass comes five minutes after boot instead of an hour.

`PrivaPub admin media audit [--fix]` compares the disk with the database. With --fix (as www-data) it gives the
pictures personas show today a row, and trashes media of deleted posts or personas, rows whose files are missing, and
files nothing holds: the leftovers of every deletion until now. MediaLifecycleTests covers each act, that the trash is
never served, and the audit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

PrivaPub/Domain/Statuses/StatusService.cs

@@ -320,6 +320,9 @@ namespace PrivaPub.Domain.Statuses
 			{
 				post.Media = media.Select(ToPostMedia).ToList();
 				await Attach(media, post.ID, token);
+				// what the edit left out is no longer held by anything
+				var kept = media.Select(m => m.ID).ToList();
+				await _media.Trash(m => m.PostId == post.ID && !kept.Contains(m.ID), "edited out", token);
 			}
 			post.Title = draft.Title == default ? post.Title : Clean(draft.Title);
 			post.SpoilerText = Clean(draft.SpoilerText);
@@ -380,6 +383,7 @@ namespace PrivaPub.Domain.Statuses
 				.Modify(p => p.Revisions, new List<PostRevision>())
 				.ExecuteAsync(token);
 			await Fanout.Deleting(post, token);
+			await _media.Trash(m => m.PostId == post.ID, "post deleted", token);
 			await DB.Default.DeleteAsync<TimelineEntry>(e => e.PostId == post.ID || e.ReblogOfPostId == post.ID);
 			// boosts of it end with it, as on Mastodon, so no count keeps them
 			await DB.Default.Update<PostEntity>().Match(p => p.ReblogOfPostId == post.ID && !p.DeletedAt.HasValue)
@@ -692,7 +696,8 @@ namespace PrivaPub.Domain.Statuses
 				return default;
 			var wanted = ids.Distinct().ToList();
 			var found = await DB.Default.Find<MediaAttachment>()
-				.Match(m => wanted.Contains(m.ID) && m.OwnerAvatarId == author.Id && (m.PostId == null || m.PostId == postId))
+				.Match(m => wanted.Contains(m.ID) && m.OwnerAvatarId == author.Id && (m.PostId == null || m.PostId == postId)
+					&& m.TrashedAt == null && m.ProfileOfAvatarId == null)
 				.ExecuteAsync(token);
 			return found.Count == wanted.Count ? wanted.Select(id => found.First(m => m.ID == id)).ToList() : default;
 		}