Persist media uploads outside public/ to survive rebuilds and redeploys

Move media storage from public/assets/images/media to storage/media
(outside Git and public/), so uploaded images, favicons and logos are
preserved across rebuilds and git clean. Add a shared media-storage helper,
update the upload/serve actions and API routes, and gitignore storage/.

src/app/api/media/[...path]/route.ts

@@ -2,10 +2,10 @@ import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
+import { MEDIA_ROOT, resolveMediaPath } from "@/lib/media-storage";
 
 export const dynamic = "force-dynamic";
 
-const MEDIA_DIR = "public/assets/images/media";
 const ALLOWED_EXT = [".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".bmp"];
 
 export async function GET(
@@ -23,8 +23,8 @@ export async function GET(
 		return new NextResponse("Forbidden", { status: 403 });
 	}
 
-	const baseDir = path.resolve(process.cwd(), MEDIA_DIR);
-	const filePath = path.resolve(baseDir, name);
+	const baseDir = MEDIA_ROOT;
+	const filePath = resolveMediaPath(name);
 	if (!filePath.startsWith(baseDir + path.sep)) {
 		return new NextResponse("Forbidden", { status: 403 });
 	}

src/app/api/media/route.ts

@@ -1,13 +1,12 @@
 import { existsSync, readdirSync } from "node:fs";
 import path from "node:path";
 import { NextResponse } from "next/server";
+import { MEDIA_ROOT } from "@/lib/media-storage";
 
 export const dynamic = "force-dynamic";
 
-const MEDIA_DIR = "assets/images/media";
-
 export async function GET() {
-	const dir = path.resolve(process.cwd(), "public", MEDIA_DIR);
+	const dir = MEDIA_ROOT;
 	// eslint-disable-next-line security/detect-non-literal-fs-filename
 	if (!existsSync(dir)) {
 		return NextResponse.json({ files: [] });