refactor(cms): deduplicate shared admin components and fix studio batch completion

- fix(studio): stop markBatchDone infinite recursion so batches complete
- refactor(api): merge api-response into api and drop the duplicate module
- refactor(media): extract shared media loader and URL validator
- refactor(ui): extract shared LoadingSpinner for site and admin groups
- refactor(dates): consolidate raw date formatting into formatDate util
- refactor(logs): share a single generic log-list loader across tables
- refactor(theme): merge both ColorField components and reuse contrast helpers
- refactor(import): extract shared ImportErrorBanner and SearchInput
- chore(): remove dead theme-editor-tabs after inlining tab components

src/lib/media-files.ts

@@ -0,0 +1,25 @@
+export type MediaFile = {
+	name: string;
+	url: string;
+	size: number;
+	uploaded: number;
+};
+
+/** Only allow safe, relative /api/media URLs as image src. */
+export function validImageUrl(url: string): string {
+	if (!url.startsWith("/")) return "";
+	if (/[<>"']/.test(url)) return "";
+	if (/(data|javascript|vbscript|file):/i.test(url)) return "";
+	return url;
+}
+
+/** Load the media library from /api/media, tolerating transient failures. */
+export async function loadMediaFiles(): Promise<MediaFile[]> {
+	try {
+		const res = await fetch("/api/media");
+		const data = await res.json();
+		return Array.isArray(data?.files) ? (data.files as MediaFile[]) : [];
+	} catch {
+		return [];
+	}
+}