feat: layout hamburger, media browser filters+previews, billing fixes

- Layout: mobile hamburger menu + overlay backdrop + close button; content area always full-width
- Media browser: filter chips (default still+turntable); advanced toggle for GLB/STL; thumbnail_url previews for non-image types; video hover-play for turntable
- Backend: asset_types multi-filter, thumbnail_url in MediaAssetOut, download proxy endpoint for MinIO/local files
- Admin: "Import Existing Media" button → POST /api/admin/import-media-assets
- Billing: fix invoice create 500 (MissingGreenlet — use selectinload after commit); PDF download uses axios blob instead of bare <a href> (auth header missing); fix storage.upload() accepting str|Path
- SSE task logs: task_logs.py core + router, LiveRenderLog component
- CadPreview: fix infinite loop when no gltf_geometry assets; loading screen before ThreeDViewer render
- render-worker: add trimesh layer to Dockerfile

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/core/task_logs.py

@@ -0,0 +1,24 @@
+"""Redis-backed task log store for SSE streaming."""
+import json
+import time
+import logging
+from app.config import settings
+
+logger = logging.getLogger(__name__)
+TASK_LOG_TTL = 3600  # 1 hour
+
+
+def log_task_event(task_id: str, message: str, level: str = "info") -> None:
+    """Append a log line to Redis list and publish to channel. Safe to call from Celery tasks."""
+    try:
+        import redis
+        r = redis.from_url(settings.redis_url)
+        entry = json.dumps({"ts": time.time(), "level": level, "msg": message, "task_id": task_id})
+        pipe = r.pipeline()
+        pipe.rpush(f"task_logs:{task_id}", entry)
+        pipe.expire(f"task_logs:{task_id}", TASK_LOG_TTL)
+        pipe.publish(f"task_logs_ch:{task_id}", entry)
+        pipe.execute()
+        r.close()
+    except Exception as exc:
+        logger.debug("log_task_event failed: %s", exc)