Media upload & automatic image variants

The media upload flow validates the real file format (not just the extension) before storing anything.

Real mime validation

The file's magic bytes are read to determine its true mime type, blocking spoofed extensions.

Generating image variants

After the original is saved, a background job generates variants (thumbnail, medium, webp) without blocking the API response.