feat(media): add reference-aware S3 image delivery

app/api/admin/media/[id]/complete/route.ts

@@ -0,0 +1,29 @@
+import * as z from "zod";
+
+import { requireAdmin } from "@/lib/auth/server";
+import { completePendingMedia } from "@/lib/media/repository";
+
+export async function POST(
+  _request: Request,
+  context: { params: Promise<{ id: string }> },
+) {
+  await requireAdmin();
+  const { id } = await context.params;
+  if (!z.string().uuid().safeParse(id).success) {
+    return Response.json({ error: "invalid-id" }, { status: 400 });
+  }
+  const result = await completePendingMedia(id);
+  if (result.status === "ready") {
+    return Response.json({
+      media: {
+        id: result.media.id,
+        fileName: result.media.fileName,
+        mimeType: result.media.mimeType,
+        byteSize: result.media.byteSize,
+        url: `/media/${result.media.id}`,
+      },
+    });
+  }
+  const status = result.status === "not-found" ? 404 : result.status === "missing" ? 409 : 422;
+  return Response.json({ error: result.status }, { status });
+}

app/api/admin/media/[id]/route.ts

@@ -0,0 +1,19 @@
+import * as z from "zod";
+
+import { requireAdmin } from "@/lib/auth/server";
+import { discardUnreferencedMedia } from "@/lib/media/repository";
+
+export async function DELETE(
+  _request: Request,
+  context: { params: Promise<{ id: string }> },
+) {
+  await requireAdmin();
+  const { id } = await context.params;
+  if (!z.string().uuid().safeParse(id).success) {
+    return Response.json({ error: "invalid-id" }, { status: 400 });
+  }
+  const deleted = await discardUnreferencedMedia(id);
+  return deleted
+    ? new Response(null, { status: 204 })
+    : Response.json({ error: "media-is-referenced-or-missing" }, { status: 409 });
+}