- classes.StoreMedia holds the media upload route's storage: extension
allowlist, 10240 KiB cap, /journal/<folder>/<name> keys with the unique
suffix, bucket write and public URL
- UploadMedia keeps authentication, permissions, the folder and form checks
and answers with the same 201 body and messages
- uniqueMediaKey fails instead of overwriting when every numbered name is
taken; the media path tests move to classes
