Add runtime-backed media library

[owjs3901]

Summary

• add durable runtime storage below the export boundary, with sharded immutable objects and plugin-declared storage/body-limit requirements
• add the media plugin with typed multipart image upload, MIME/signature and size enforcement, stable media:<id> references, public streaming, audited deletion, settings, and an admin library UI
• register media in the example app and cover auth boundaries, upload/serve/list/delete, settings limits, storage reclamation, audit events, and OpenAPI routes

Browser QA

• signed in through the real app and uploaded native files through the file input
• visually verified the media grid, a 512x512 preview, metadata, stable reference, and copied state
• verified the public image in an isolated cookie-free browser profile
• changed the typed upload limit from 5 MiB to 1 MiB and observed the live UI update
• deleted both assets, observed the empty state, and confirmed the deleted public reference returns 404
• captured 94 requests with no failed responses and 22 console messages with no warnings/errors

Full gate

• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace
• RUSTDOCFLAGS=-D warnings cargo doc --workspace --no-deps
• bunx oxlint
• bun x tsc --noEmit in the template, example app, and every plugin
• cargo run -p yeollin-cli -- build --skip-backend from apps/example-app (16 routes prerendered)