Serve every media file privately at /media/<id>

There is no public media any more. `/media/public/<id>` served a media
row with no session at all, so anyone with the id could read a file.
The public/private split is gone: the path is `/media/<id>` (and
`/media/<id>/thumbnail`), every request is signed in first, and
`grabUserMedia` decides whether the user may see it: their own upload,
a bot's or workspace's picture or file they reach, or a file on a task
they reach. Anything else is a 404 before a path is built.

The `media.is_private` column and the two per-user directories went
with it: uploads live in `media/<user_id>/` and there is nothing to
pick between. The files browser's media volume is now the viewer's
own folder whatever their role.

Bots also say which of the two things they mean. A `[file:ID]` ref is a
saved file and its chip opens the bytes; a folder is a new
`[folder:volume:owner:path]` ref (`src/utils/folder-ref.ts`) whose chip
opens the files browser there and downloads nothing. The old `[path:...]`
ref and the extension sniffing that guessed file from folder are gone,
so `import_file` names the folder holding a file it copied rather than
the file itself.

The prompts say what the Assistant got wrong: list before importing or
saving, one copy per artifact, never split a file into parts unless
asked, never claim the store is empty without a fresh list, and never
invent a size cap. A re-import now says the path already existed
instead of silently overwriting and reporting a fresh copy.

src/functions/backend/db/bot-files/record-bot-file.ts

@@ -220,7 +220,6 @@ async function insertMediaRow({
                 media_type: media_type as any,
                 media_write_path: write_path,
                 mime_type: mime,
-                is_private: 1,
             },
         ],
     });

src/functions/backend/db/media/grab-media.ts

@@ -43,18 +43,6 @@ export default async function grabMedia(
             values.push(...query.media_paradigms, query.media_paradigms.length);
         }
 
-        if (query?.is_media_private) {
-            sql += `    AND m.is_private = 1\n`;
-            if (!user?.id) {
-                throw new Error(`Private media requires authenticated user`);
-            } else {
-                sql += `    AND m.user_id = ?\n`;
-                values.push(user.id);
-            }
-        } else {
-            sql += `    AND COALESCE(m.is_private, 0) <> 1\n`;
-        }
-
         if (query?.id) {
             sql += `    AND m.id = ?\n`;
             values.push(query.id);

src/functions/backend/db/media/grab-user-media.ts

@@ -0,0 +1,56 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import type { BUN_SQLITE_COBBLE_MEDIA, BunSQLiteTables } from "@/db/types/db";
+import grabSharedPictureMedia from "@/src/functions/backend/db/access/grab-shared-picture-media";
+import grabBotFileMedia from "@/src/functions/backend/db/bot-files/grab-bot-file-media";
+import grabTaskMediaFile from "@/src/functions/backend/db/tasks/grab-task-media-file";
+
+type Params = {
+    media_id: number | string;
+    user_id: number | string;
+};
+
+/**
+ * One media row, only if this user may load its bytes. Every media URL is
+ * `/media/<id>` and every one of them is private, so this is the single
+ * gate in front of the file on disk:
+ *
+ * - the user's own uploads (`media.user_id`),
+ * - a bot's or workspace's picture, to whoever reaches that bot or
+ *   workspace (`grabSharedPictureMedia`),
+ * - a bot's or workspace's file, to whoever reaches the folder it lives in
+ *   (`grabBotFileMedia`),
+ * - a file attached to a task, to whoever reaches the task
+ *   (`grabTaskMediaFile`).
+ *
+ * Null when it is not theirs to see, so a request never turns into a path
+ * before this has passed.
+ */
+export default async function grabUserMedia({
+    media_id,
+    user_id,
+}: Params): Promise<BUN_SQLITE_COBBLE_MEDIA | undefined> {
+    if (!media_id || !user_id) return undefined;
+
+    const own = await BunSQLite.select<
+        BUN_SQLITE_COBBLE_MEDIA,
+        (typeof BunSQLiteTables)[number]
+    >({
+        table: "media",
+        query: {
+            query: {
+                user_id: {
+                    value: user_id,
+                },
+            },
+        },
+        targetId: media_id,
+    });
+
+    return (
+        own.singleRes ||
+        (await grabSharedPictureMedia({ media_id, user_id })) ||
+        (await grabBotFileMedia({ media_id, user_id })) ||
+        (await grabTaskMediaFile({ media_id, user_id })) ||
+        undefined
+    );
+}

src/functions/backend/db/profile-images/set-profile-image.ts

@@ -62,7 +62,6 @@ export default async function setProfileImage({ user_id, target, id, data_url }:
             media_mime_type: ext,
             media_paradigms: [paradigm],
             media: { title: `${record.name || target} picture` },
-            is_private: true,
             user: { id: Number(user_id) },
         });
 

src/functions/backend/db/users/media/upload-and-record-media.ts

@@ -34,7 +34,6 @@ type Params = {
     media?: BUN_SQLITE_COBBLE_MEDIA;
     media_name?: string;
     media_mime_type?: string;
-    is_private?: boolean;
     image_width?: number;
     image_height?: number;
     thumbnail_width?: number;
@@ -53,7 +52,6 @@ export default async function uploadAndRecordMedia({
     media,
     media_mime_type,
     media_name,
-    is_private,
     image_width,
     image_height,
     thumbnail_width,
@@ -64,17 +62,10 @@ export default async function uploadAndRecordMedia({
     let target_file_name = `${media_name || now}`;
     let target_file_thumbnail_name = `${media_name || now}-thumb`;
 
-    const {
-        USER_MEDIA_PRIVATE_RELATIVE_DIR,
-        USER_MEDIA_PUBLIC_RELATIVE_DIR,
-        DATA_DIR,
-    } = grabDirNames({
-        user,
-    });
-
-    const MEDIA_RELATIVE_DIR = is_private
-        ? USER_MEDIA_PRIVATE_RELATIVE_DIR
-        : USER_MEDIA_PUBLIC_RELATIVE_DIR;
+    const { USER_MEDIA_RELATIVE_DIR: MEDIA_RELATIVE_DIR, DATA_DIR } =
+        grabDirNames({
+            user,
+        });
 
     if (!MEDIA_RELATIVE_DIR) {
         throw new Error(`No target media directory found!`);
@@ -236,7 +227,6 @@ export default async function uploadAndRecordMedia({
          * lets NULLs repeat.
          */
         is_primary: is_primary ? 1 : (null as any),
-        is_private: is_private ? 1 : 0,
         media_write_path: media_write_path,
         media_thumbnail_write_path:
             media_type === "image" ? media_thumbnail_write_path : undefined,