feat(E): add MediaAsset catalog — model, CRUD API, MediaBrowser UI

Migration 040: media_assets table with RLS (tenant_isolation + admin_bypass).
domains/media/: MediaAsset model, schemas, service, router with ZIP-download.
publish_asset Celery task in rendering/tasks.py.
core/storage.py: download_bytes() method for MinIO + LocalStorage.
frontend: MediaBrowser.tsx (grid/list, multi-select, zip-download, pagination) + api/media.ts.
Route /media (AdminRoute) + sidebar link with Image icon for admin+pm.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/models/__init__.py

@@ -12,6 +12,7 @@ from app.domains.notifications.models import AuditLog
 from app.domains.billing.models import PricingTier
 from app.domains.rendering.models import OutputType, RenderTemplate, ProductRenderPosition, WorkflowDefinition, WorkflowRun, WorkflowNodeResult
 from app.domains.materials.models import Material, MaterialAlias
+from app.domains.media.models import MediaAsset, MediaAssetType
 
 # Also re-export SystemSetting (no domain assigned — stays as-is)
 from app.models.system_setting import SystemSetting
@@ -20,5 +21,5 @@ __all__ = [
     "Tenant", "User", "Template", "CadFile", "Product", "Order", "OrderItem", "OrderLine",
     "AuditLog", "PricingTier", "OutputType", "RenderTemplate", "ProductRenderPosition",
     "WorkflowDefinition", "WorkflowRun", "WorkflowNodeResult",
-    "Material", "MaterialAlias", "SystemSetting",
+    "Material", "MaterialAlias", "MediaAsset", "MediaAssetType", "SystemSetting",
 ]