Persist media uploads outside public/ to survive rebuilds and redeploys

Move media storage from public/assets/images/media to storage/media
(outside Git and public/), so uploaded images, favicons and logos are
preserved across rebuilds and git clean. Add a shared media-storage helper,
update the upload/serve actions and API routes, and gitignore storage/.

.gitignore

@@ -20,3 +20,6 @@ db_backup_*.sql
 
 # Local gitea binary symlink
 gitea
+
+# Runtime uploaded media (persistent, outside public/)
+storage/