feat(15-03): add journal media upload, RSS, and off-by-default Typesense gate

- POST /_journal/api/v1/media/upload requires access_posts and stays under journal/
- Anonymous GET rss is RSS 2.0 honoring rss_* settings; unpublished posts are omitted
- beachcomber Gate reads search_use_typesense (default false) so a fresh save makes no Typesense HTTP

Co-authored-by: Cursor <cursoragent@cursor.com>

posts_admin_smoke_test.go

@@ -151,7 +151,7 @@ func adminAPI(rel string) string {
 	return cabana.DefaultAdminPrefix + "/api/v1" + rel
 }
 
-func newPostsEnv(t *testing.T) *adminEnv {
+func newPostsEnv(t *testing.T, extraEnv ...string) *adminEnv {
 	t.Helper()
 	sqlDB := dedicatedDB(t, "journal_admin_"+strconv.FormatInt(time.Now().UnixNano(), 10))
 	gdb, err := lagoon.Use(t.Context(), sqlDB)
@@ -164,10 +164,10 @@ func newPostsEnv(t *testing.T) *adminEnv {
 	}
 	cfg, err := compass.Open(compass.Options{
 		Dir: dir,
-		Environ: []string{
+		Environ: append([]string{
 			"SUMMER_ENV=development",
 			"SUMMER_ADMIN__JWT__SECRET=" + adminJWTSecret,
-		},
+		}, extraEnv...),
 	})
 	if err != nil {
 		t.Fatal(err)