feat: improve media delivery and web upload pipeline

- make minio bucket downloadable for direct media links

- switch object keys to random uuid-based names

- add client-side image compression before upload

app/media/service.py

@@ -1,4 +1,4 @@
-import re
+import mimetypes
 from urllib.parse import quote
 from uuid import uuid4
 
@@ -27,14 +27,13 @@ ALLOWED_MIME_TYPES = {
     "text/plain",
 }
 
-_SAFE_NAME_RE = re.compile(r"[^a-zA-Z0-9._-]+")
-
-
-def _sanitize_filename(file_name: str) -> str:
-    sanitized = _SAFE_NAME_RE.sub("_", file_name).strip("._")
-    if not sanitized:
-        sanitized = "file.bin"
-    return sanitized[:120]
+def _extension_from_mime(file_type: str) -> str:
+    ext = mimetypes.guess_extension(file_type)
+    if not ext:
+        return ".bin"
+    if ext == ".jpe":
+        return ".jpg"
+    return ext
 
 
 def _build_file_url(bucket: str, object_key: str) -> str:
@@ -71,8 +70,8 @@ def _get_s3_client(endpoint_url: str):
 async def generate_upload_url(payload: UploadUrlRequest) -> UploadUrlResponse:
     _validate_media(payload.file_type, payload.file_size)
 
-    file_name = _sanitize_filename(payload.file_name)
-    object_key = f"uploads/{uuid4()}-{file_name}"
+    extension = _extension_from_mime(payload.file_type)
+    object_key = f"uploads/{uuid4().hex}{extension}"
     bucket = settings.s3_bucket_name
 
     try: