Add gallery admin and video media support.

This updates gallery handling to support video playback with generated poster thumbnails, adds authenticated admin upload/delete flows, and improves dev/runtime behavior including reliable thumbnail generation and media-safe response handling.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/internal/gallery/media_test.go

@@ -0,0 +1,44 @@
+package gallery
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestVideoPosterRel(t *testing.T) {
+	if got := videoPosterRel("portal/clip.mp4"); got != "portal/clip.jpg" {
+		t.Fatalf("got %q", got)
+	}
+}
+
+func TestList_includesVideo(t *testing.T) {
+	dir := t.TempDir()
+	album := filepath.Join(dir, "portal")
+	if err := os.MkdirAll(album, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	name := "showreel.mp4"
+	if err := os.WriteFile(filepath.Join(album, name), []byte("fake"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	images, err := List(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(images) != 1 || !images[0].IsVideo || images[0].RelPath != "portal/"+name {
+		t.Fatalf("got %+v", images)
+	}
+}
+
+func TestSelectHero_skipsVideo(t *testing.T) {
+	images := []Image{
+		{RelPath: "portal/showreel.mp4", IsVideo: true},
+		{RelPath: "portal/photo.jpg", IsVideo: false},
+	}
+	hero, ok := SelectHero(images)
+	if !ok || hero.RelPath != "portal/photo.jpg" {
+		t.Fatalf("got %+v ok=%v", hero, ok)
+	}
+}