[adm 14] Build `/ankh/media` and restore production-ready asset/media authoring

[artiphishle]

Roadmap: #115

Respect the roadmap first and the AGENTS.md file of every repository touched.

Previous roadmap step

[adm 13] (#128) establishes full canonical Theme authoring. This final roadmap issue restores asset/media authoring as a first-class app-level capability and connects instance media properties to a reusable media pool rather than a one-off upload field.

Repository impact

Likely after investigation:

• ankhorage/studio
• ankhorage/contracts for canonical serializable asset/media references if missing
• ankhorage/zora for imageAsset/media authoring metadata or reusable chooser fields where appropriate
• the owning infrastructure/storage package(s)
• provider adapter packages where storage upload/list/delete behavior is owned

Pause at package release boundaries per roadmap rule #6.

Goal

Build /ankh/media as the canonical Studio media pool for app-authoring assets and restore production-ready media selection/upload for instance properties such as Image source.

Do not treat this as merely "bring back the Image upload button". First establish the correct boundary between app-bundled assets, Studio-managed media, infrastructure object storage and runtime user-generated uploads.

Required architecture investigation

Before implementation, explicitly audit and document:

1. What the current generated infra.storage configuration is intended to provide.
2. Which files belong in app-bundled /assets and are shipped with the app bundle/store build.
3. Which authoring media should remain remote/provider-backed instead of bundled.
4. Where runtime/user-generated uploads such as avatars or timeline-post images belong.
5. Whether authoring media and runtime user uploads may share the same physical storage provider while remaining logically separated by bucket/prefix/policy.
6. How web, iOS and Android source selection/upload should work.
7. What canonical provider-neutral asset/media reference must be serialized into the manifest/config.

Do not assume every storage object belongs in /assets, and do not assume every app-authoring asset should be runtime user storage. Choose and document the production architecture.

Asset reference

Define/use a stable serializable reference that identifies an asset independently of temporary local/browser state.

The exact contract must be decided by current ownership, but it must not persist temporary values such as:

• blob: URLs;
• local device picker URLs that disappear;
• browser-only object URLs;
• trusted provider credentials.

A canonical reference may resolve a bundled asset, managed app media object or provider-backed object through owning adapters. Do not hardcode one storage provider into manifest nodes.

/ankh/media

Provide a production-quality media pool that can, according to the final architecture:

• list/manage app-authoring media;
• show type/kind such as image/audio/video/font/other supported categories;
• show useful metadata such as name, dimensions/duration/size where available;
• upload/import media;
• select media for component properties;
• paste/import an external URL where allowed and clearly define whether it remains remote or is ingested;
• safely remove media only when references/usage allow it;
• provide loading/empty/error/unsupported states.

Do not expose runtime user-generated private data in an app-authoring media pool.

Component property integration

For an instance-authorable media property such as Image source, the Properties workflow should support the appropriate options from the final architecture, for example:

• choose from device/photo library where supported;
• upload/import into the media pool;
• select an existing media-pool item;
• paste a URL where supported.

All paths must resolve to the canonical stable reference persisted in the manifest.

Use ZORA metadata/authoring contracts rather than Studio hardcoding Image-only behavior where the capability is reusable for future audio/video/media components.

Security

Preserve trusted storage boundaries:

• browser/native clients never receive service-role credentials or equivalent server secrets;
• upload/list/delete operations use appropriate trusted APIs or scoped provider credentials;
• authorization/policies are explicit;
• user-generated runtime uploads remain governed by runtime auth/storage policy, not Studio authoring shortcuts.

Historical reference: ankhorage4 PR #233 wired image uploads to infra storage with optimistic local preview and persisted only stable serializable references. Preserve that safety principle while redesigning the broader media architecture.

Likely files

Studio, non-exhaustive:

src/studioAdminRouteModel.ts
src/ui/admin/AnkhAdminShell.tsx
src/ui/admin/pages/*
src/core/StudioProvider.ts
src/manifestState.ts
src/host/http/*

Other repos/files must be discovered from current asset/storage/provider ownership before coding.

Phases

Phase 1 — media/storage architecture and contracts

Audit /assets, infra.storage, runtime user uploads and authoring media. Define canonical media reference and ownership boundaries in owning packages.

Phase 2 — media service/provider adapters

Implement provider-neutral list/upload/import/delete/resolve capabilities with secure trusted boundaries.

Phase 3 — /ankh/media pool

Build first-class media browsing/management and usage/reference safeguards.

Phase 4 — Properties integration

Connect instance-authorable media properties to device selection, upload, media-pool selection and supported URL flows through one reusable chooser model.

Tests

Cover at minimum:

• canonical media-reference serialization/resolution;
• temporary blob/local URLs never persisted;
• bundled vs managed/provider-backed reference handling;
• upload/list/delete provider adapter behavior through unit-testable boundaries;
• media type/metadata normalization;
• usage/reference detection before removal;
• Properties media selection mutation;
• URL import/reference behavior according to chosen policy;
• browser-safe responses/no secret leakage;
• explicit separation from runtime user-generated upload data.

Acceptance criteria

1. /ankh/media is the canonical app-authoring media pool.
2. The architecture clearly distinguishes app-bundled assets, Studio-managed authoring media and runtime user-generated uploads.
3. The intended purpose of generated infra.storage is documented and used consistently.
4. One stable provider-neutral serializable media/asset reference model exists.
5. Temporary blob/local picker URLs and secrets are never persisted.
6. Media can be listed/imported/uploaded/selected and safely removed according to usage rules.
7. Instance-authorable media properties use the reusable media workflow.
8. Web/native device selection is supported through appropriate platform capabilities without duplicating persistence models.
9. Storage provider details remain behind owning adapters/trusted boundaries.
10. Runtime user uploads are not conflated with the Studio authoring media pool.
11. Behavior-focused tests and full validation pass.
12. No legacy/compatibility/ankhorage4 dependency is introduced.