Stream media through the backend (browser-reachable, privacy-checked)

Presigned URLs point at the internal minio:9000 host a browser can't reach. Add ObjectStore.get_object and a GET /media/{id}/content endpoint that resolves visibility and streams the bytes; MediaRead.url now points there. Keeps the object store private and downloads behind the privacy engine.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

backend/app/integrations/objectstore/base.py

@@ -15,6 +15,9 @@ class ObjectStore(ABC):
     @abstractmethod
     async def put_object(self, *, key: str, data: bytes, content_type: str) -> None: ...
 
+    @abstractmethod
+    async def get_object(self, *, key: str) -> bytes: ...
+
     @abstractmethod
     async def presigned_get_url(self, *, key: str) -> str: ...