Media library screen: upload, browse, organize and where used #2595

Part of #2427 (F-MED). The media library screen (MED-01 UI): upload, browse, organize and where used, on the merged IMediaLibrary (#2543) and IWhereUsed.ForMediaAsync (#2494). It follows the desk's layout and conventions from #2422.

Scope

• Host, next to the audit export endpoint:
  • POST /media/upload takes the file and its metadata from a multipart form with the anti-forgery token, calls IMediaLibrary.UploadAsync and redirects to the new asset. A refused upload redirects back to /media with the error codes and the fields typed, as the audit export does.
  • GET /media/{id}/file (optionally ?version=n) streams the bytes for a signed-in person. Images are inline, so the library can preview them. Other types are attachments. Every response has X-Content-Type-Options: nosniff and Cache-Control: private, no-store.
• Admin, static server rendering:
  • /media lists the assets, newest first, in a table. It filters by folder (?folder=products&sub=1 for subfolders) and by tag, with the folders as links.
    • Each row has a preview for images, the file name linked to the asset, type, size, folder, tags, whether it is published, and a "No alt text" badge for an image without one (MED-02).
    • An upload card has the file, folder, tags, alt text and caption. Errors show next to their fields.
  • /media/{id} shows the preview, the latest version and whether it is published, and a metadata form (file name, folder, tags, alt text, caption). The form saves a new version from the version the page read, so a concurrent change is reported, not overwritten.
  • Where used: the entries whose latest draft or published version references the asset, with the paths, each linked to the entry's audit history.
  • A Media link in the header.
• Strings through IStringLocalizer, logical utilities only, components from Components/Ui only. The desk's axe checks cover both pages.

Out of scope

• Uploads and metadata changes as change set operations with the uploader as initiator: Put media in change sets and add the media tools #2546 puts them in change sets. When it lands, the screen's two calls pass the person's change set target like the other writes, which that PR or the next does.
• Soft delete and restore of assets (Soft delete and restore media assets #2553).
• Attaching an asset to a field from the library: that comes with generated forms (F-FRM F-FRM: Generated forms as the human fallback editor #2426).
• Image variants and thumbnails generated on the server (out of scope for M1). The preview is the image itself, scaled by CSS.

Acceptance

• An administrator uploads an image with alt text through the library and lands on the asset, and its bytes are served back with the declared type.
• A file whose bytes do not match its declared type, or a type the library refuses, is reported next to the file field, and nothing is stored.
• The list filters by folder, subfolders and tag, and an image without alt text is marked.
• Editing the metadata stores the next version. A form from an older version is refused with a message.
• Where used lists the entry that references the asset.
• An anonymous request to any of the pages or endpoints goes to sign-in, and a post without the anti-forgery token changes nothing.
• Integration tests pass on SQLite and PostgreSQL. The pages pass the axe checks in both directions.