- classes.StoreMedia holds the media upload route's storage: extension allowlist, 10240 KiB cap, /journal/<folder>/<name> keys with the unique suffix, bucket write and public URL - UploadMedia keeps authentication, permissions, the folder and form checks and answers with the same 201 body and messages - uniqueMediaKey fails instead of overwriting when every numbered name is taken; the media path tests move to classes