feat(E): add MediaAsset catalog — model, CRUD API, MediaBrowser UI

Migration 040: media_assets table with RLS (tenant_isolation + admin_bypass).
domains/media/: MediaAsset model, schemas, service, router with ZIP-download.
publish_asset Celery task in rendering/tasks.py.
core/storage.py: download_bytes() method for MinIO + LocalStorage.
frontend: MediaBrowser.tsx (grid/list, multi-select, zip-download, pagination) + api/media.ts.
Route /media (AdminRoute) + sidebar link with Image icon for admin+pm.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/App.tsx

@@ -18,6 +18,7 @@ import NotificationsPage from './pages/Notifications'
 import PreferencesPage from './pages/Preferences'
 import TenantsPage from './pages/Tenants'
 import WorkflowEditorPage from './pages/WorkflowEditor'
+import MediaBrowserPage from './pages/MediaBrowser'
 
 function ProtectedRoute({ children }: { children: React.ReactNode }) {
   const token = useAuthStore((s) => s.token)
@@ -82,6 +83,14 @@ export default function App() {
           <Route path="notifications" element={<NotificationsPage />} />
           <Route path="preferences" element={<PreferencesPage />} />
           <Route path="cad/:id" element={<CadPreviewPage />} />
+          <Route
+            path="media"
+            element={
+              <AdminRoute>
+                <MediaBrowserPage />
+              </AdminRoute>
+            }
+          />
         </Route>
       </Routes>
     </BrowserRouter>