Persist media uploads outside public/ to survive rebuilds and redeploys

Move media storage from public/assets/images/media to storage/media
(outside Git and public/), so uploaded images, favicons and logos are
preserved across rebuilds and git clean. Add a shared media-storage helper,
update the upload/serve actions and API routes, and gitignore storage/.

src/lib/media-storage.ts

@@ -0,0 +1,15 @@
+import path from "node:path";
+
+/**
+ * Persistent media root. Lives outside `public/` and outside Git so uploads
+ * survive rebuilds, redeploys and `git clean`. Served through /api/media.
+ */
+export const MEDIA_ROOT = path.resolve(process.cwd(), "storage", "media");
+
+export function resolveMediaPath(...segments: string[]): string {
+	const target = path.resolve(MEDIA_ROOT, ...segments);
+	if (target !== MEDIA_ROOT && !target.startsWith(MEDIA_ROOT + path.sep)) {
+		throw new Error("Invalid media path");
+	}
+	return target;
+}