Add Media manager (/admin/media), remove unused images/ scaffolding

Upload/browse/delete UI for files under public/uploads/, covered by the
existing /admin/* auth gate with no separate feature flag needed (no
SQLite dependency to gate). Extension allowlist and max upload size are
configurable; filenames are sanitized and de-duplicated on upload, and
deletes re-verify the resolved path lands inside the upload directory
before touching disk. Docker gains a fourth-turned-third named volume
for public/uploads/ so uploads survive a rebuild.

images/ (reserved scaffolding for a future image feature) is removed —
nothing ever consumed it, and public/uploads/ now covers that use case.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -5,8 +5,8 @@ services:
       - "8080:80"
     volumes:
       - cache:/var/www/html/public/cache
+      - uploads:/var/www/html/public/uploads
       - data:/var/www/html/data
-      - images:/var/www/html/images
       # Uncomment to override the baked-in App/ with a host copy, no rebuild:
       # - ./App:/var/www/html/App
 
@@ -24,6 +24,6 @@ services:
 
 volumes:
   cache:
+  uploads:
   data:
-  images:
   # mysql-data: