feat(media): add reference-aware S3 image delivery

tests/security-boundaries.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+
+const protectedEntryPoints = [
+  "app/admin/actions.ts",
+  "app/api/admin/media/presign/route.ts",
+  "app/api/admin/media/[id]/complete/route.ts",
+  "app/api/admin/media/[id]/route.ts",
+] as const;
+
+describe("administrative security boundaries", () => {
+  for (const path of protectedEntryPoints) {
+    it(`${path} repeats server-side admin authorization`, async () => {
+      const source = await Bun.file(new URL(`../${path}`, import.meta.url)).text();
+      expect(source).toContain("requireAdmin");
+      expect(source).toMatch(/await requireAdmin\(\)/u);
+    });
+  }
+
+  it("same-origin media checks visibility before falling back to admin auth", async () => {
+    const source = await Bun.file(
+      new URL("../app/media/[id]/route.ts", import.meta.url),
+    ).text();
+    expect(source).toContain("getMediaVisibility");
+    expect(source).toContain("getAdminSession");
+    expect(source.indexOf("getMediaVisibility")).toBeLessThan(
+      source.lastIndexOf("getAdminSession"),
+    );
+  });
+});