admin: publish files to the public bucket

There was no way to put a file up for public use short of running an
S3 client with the uploader key. Add a "files" area to the admin:
upload one or more files, copy the link, edit the note, replace the
contents under the same link, delete. It has its own read/write/delete
permission flags like the other areas, and every action is audited.

The objects go to the storage stack's public bucket and are served by
Garage at s3.asxp.io/public/<key>, not by this app. The app's key can
only put and delete there, so a public_files table is the record of
what was published. Keys get a random prefix: links are not guessable
and names never collide.

That host is same-site with the admin, so a file that can carry script
must not render there. Only a fixed list of types (images, PDF, plain
text, audio, video) is served inline; the rest, HTML and SVG included,
is stored as an attachment. Image metadata is stripped by default, as
for the bingo photos, because of GPS tags.

A per-file limit and a total quota keep the small disk on asxpio-ops
from filling up.

Assisted-by: Claude:fable-5-2

lib/s3.rb

@@ -30,16 +30,21 @@ module S3
     ENV.fetch('S3_BUCKET')
   end
 
-  def put(key, bytes, content_type: 'application/pdf', bucket: self.bucket)
+  def put(key, bytes, content_type: 'application/pdf', bucket: self.bucket, **headers)
     client.put_object(
       bucket:       bucket,
       key:          key,
       body:         bytes,
-      content_type: content_type
+      content_type: content_type,
+      **headers # content_disposition, cache_control
     )
     key
   end
 
+  def delete(key, bucket: self.bucket)
+    client.delete_object(bucket: bucket, key: key)
+  end
+
   def get(key, bucket: self.bucket)
     client.get_object(bucket: bucket, key: key).body.read.b # body is a UTF-8 StringIO
   end