Stream media through the backend (browser-reachable, privacy-checked)

Presigned URLs point at the internal minio:9000 host a browser can't reach. Add ObjectStore.get_object and a GET /media/{id}/content endpoint that resolves visibility and streams the bytes; MediaRead.url now points there. Keeps the object store private and downloads behind the privacy engine.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

backend/tests/conftest.py

@@ -46,6 +46,9 @@ class FakeObjectStore(ObjectStore):
     async def put_object(self, *, key: str, data: bytes, content_type: str) -> None:
         self.objects[key] = (data, content_type)
 
+    async def get_object(self, *, key: str) -> bytes:
+        return self.objects[key][0]
+
     async def presigned_get_url(self, *, key: str) -> str:
         return f"https://objects.test/{key}"