feat(E): add MediaAsset catalog — model, CRUD API, MediaBrowser UI

Migration 040: media_assets table with RLS (tenant_isolation + admin_bypass).
domains/media/: MediaAsset model, schemas, service, router with ZIP-download.
publish_asset Celery task in rendering/tasks.py.
core/storage.py: download_bytes() method for MinIO + LocalStorage.
frontend: MediaBrowser.tsx (grid/list, multi-select, zip-download, pagination) + api/media.ts.
Route /media (AdminRoute) + sidebar link with Image icon for admin+pm.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/main.py

@@ -19,6 +19,7 @@ from app.domains.notifications.router import router as notifications_router
 from app.domains.billing.router import router as pricing_router
 from app.domains.tenants.router import router as tenants_router
 from app.domains.rendering.workflow_router import router as workflows_router
+from app.domains.media.router import router as media_router
 
 
 @asynccontextmanager
@@ -78,6 +79,7 @@ app.include_router(render_templates_router, prefix="/api")
 app.include_router(notifications_router, prefix="/api")
 app.include_router(tenants_router, prefix="/api")
 app.include_router(workflows_router)
+app.include_router(media_router)
 
 
 @app.get("/health")