Private upload

Clean media, add metadata, route it to the right page.

The browser strips metadata, converts the file to WebP with a WASM encoder, and uploads the result with a JSON sidecar for the build pipeline.