Make artifact and media metadata first-class server records

Artifact and media metadata were previously reconstructed from job result
refs and JSON sidecar files. This change regularizes metadata into SQLite,
keeps filesystem blobs in place, and preserves backward compatibility via
lazy fallback and backfill from existing job refs and JSON metadata.

Constraint: Blob storage remains on the local filesystem in this phase
Rejected: Migrate blobs into SQLite | larger scope and worse operational profile for current media sizes
Rejected: Hard cutover without fallback | unsafe for historical data already on the test server
Confidence: medium
Scope-risk: moderate
Directive: Treat SQLite as the metadata source of truth; JSON sidecars are compatibility fallback only
Tested: go test ./...; deployed to test server 101.42.99.35; verified /v1/artifacts, /v1/artifacts/:id, signed media URL 200, unsigned content 401
Not-tested: Full historical backfill sweep over all existing artifact rows under production-sized data volume

internal/server/media.go

@@ -2,7 +2,9 @@ package server
 
 import (
 	"context"
+	"crypto/hmac"
 	"crypto/sha256"
+	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
@@ -10,6 +12,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"time"
 )
@@ -59,11 +62,95 @@ func publicBaseURL(cfg Config) string {
 	return strings.TrimRight(base, "/")
 }
 
+func mediaContentPath(mediaID string) string {
+	return "/v1/media/" + url.PathEscape(strings.TrimSpace(mediaID)) + "/content"
+}
+
 func mediaContentURL(cfg Config, mediaID string) string {
+	return publicBaseURL(cfg) + mediaContentPath(mediaID)
+}
+
+func mediaURLTTL() time.Duration {
+	return 24 * time.Hour
+}
+
+func mediaURLExpiry(now time.Time) time.Time {
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	return now.UTC().Add(mediaURLTTL())
+}
+
+func mediaURLSecret(cfg Config) []byte {
+	return []byte(defaultString(strings.TrimSpace(cfg.SessionSecret), "popiart-dev-session-secret"))
+}
+
+func signedMediaContentURL(cfg Config, mediaID string, now time.Time) string {
+	expiresAt := mediaURLExpiry(now)
+	baseURL := mediaContentURL(cfg, mediaID)
+	exp := strconv.FormatInt(expiresAt.Unix(), 10)
+	sig := signMediaAccess(cfg, mediaID, exp)
+	return baseURL + "?exp=" + url.QueryEscape(exp) + "&sig=" + url.QueryEscape(sig)
+}
+
+func signMediaAccess(cfg Config, mediaID, exp string) string {
+	mac := hmac.New(sha256.New, mediaURLSecret(cfg))
+	_, _ = mac.Write([]byte(strings.TrimSpace(mediaID)))
+	_, _ = mac.Write([]byte("\n"))
+	_, _ = mac.Write([]byte(strings.TrimSpace(exp)))
+	return base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
+}
+
+func validateSignedMediaAccess(cfg Config, mediaID, exp, sig string, now time.Time) bool {
+	exp = strings.TrimSpace(exp)
+	sig = strings.TrimSpace(sig)
+	if exp == "" || sig == "" {
+		return false
+	}
+	unix, err := strconv.ParseInt(exp, 10, 64)
+	if err != nil {
+		return false
+	}
+	if now.IsZero() {
+		now = time.Now().UTC()
+	}
+	if now.UTC().After(time.Unix(unix, 0).UTC()) {
+		return false
+	}
+	expected := signMediaAccess(cfg, mediaID, exp)
+	return hmac.Equal([]byte(expected), []byte(sig))
+}
+
+func mediaView(cfg Config, record mediaRecord, now time.Time) media {
+	view := record.media
+	view.URL = signedMediaContentURL(cfg, record.ID, now)
+	return view
+}
+
+func artifactView(cfg Config, item artifact, now time.Time) artifact {
+	view := item
+	if strings.TrimSpace(view.MediaID) != "" {
+		view.URL = signedMediaContentURL(cfg, view.MediaID, now)
+	}
+	return view
+}
+
+func artifactViews(cfg Config, items []artifact, now time.Time) []artifact {
+	if len(items) == 0 {
+		return nil
+	}
+	out := make([]artifact, 0, len(items))
+	for _, item := range items {
+		out = append(out, artifactView(cfg, item, now))
+	}
+	return out
+}
+
+func mediaContentURLCanonical(cfg Config, mediaID string) string {
 	return publicBaseURL(cfg) + "/v1/media/" + url.PathEscape(strings.TrimSpace(mediaID)) + "/content"
 }
 
-func persistMediaContent(cfg Config, userID, projectID, artifactID, filename, contentType, visibility string, content []byte, mediaID string) (mediaRecord, error) {
+func persistMediaContent(cfg Config, repo MediaRepository, userID, projectID, artifactID, filename, contentType, visibility string, content []byte, mediaID string) (mediaRecord, error) {
 	if len(content) == 0 {
 		return mediaRecord{}, fmt.Errorf("media content is required")
 	}
@@ -105,7 +192,7 @@ func persistMediaContent(cfg Config, userID, projectID, artifactID, filename, co
 			ContentType: contentType,
 			SizeBytes:   int64(len(content)),
 			CreatedAt:   time.Now().UTC().Format(time.RFC3339),
-			URL:         mediaContentURL(cfg, mediaID),
+			URL:         mediaContentURLCanonical(cfg, mediaID),
 			Visibility:  visibility,
 			SHA256:      hex.EncodeToString(sum[:]),
 		},
@@ -120,10 +207,15 @@ func persistMediaContent(cfg Config, userID, projectID, artifactID, filename, co
 	if err := os.WriteFile(mediaMetaPath(cfg, mediaID), metaBytes, 0o644); err != nil {
 		return mediaRecord{}, err
 	}
+	if repo != nil {
+		if err := repo.UpsertMedia(record); err != nil {
+			return mediaRecord{}, err
+		}
+	}
 	return record, nil
 }
 
-func loadMediaRecord(cfg Config, mediaID string) (*mediaRecord, bool, error) {
+func loadMediaRecordFromJSON(cfg Config, mediaID string) (*mediaRecord, bool, error) {
 	mediaID = strings.TrimSpace(mediaID)
 	if mediaID == "" {
 		return nil, false, nil
@@ -162,8 +254,7 @@ func (s *Server) persistResultRefs(ctx context.Context, record *job, refs []resu
 			filename = inferFilenameFromRef(ref, buildArtifactID(record.JobID, idx))
 		}
 		artifactID := buildArtifactID(record.JobID, idx)
-		mediaRecord, err := persistMediaContent(
-			s.cfg,
+		mediaRecord, err := s.store.persistMediaContent(
 			record.UserID,
 			record.ProjectID,
 			artifactID,