feat: layout hamburger, media browser filters+previews, billing fixes

- Layout: mobile hamburger menu + overlay backdrop + close button; content area always full-width
- Media browser: filter chips (default still+turntable); advanced toggle for GLB/STL; thumbnail_url previews for non-image types; video hover-play for turntable
- Backend: asset_types multi-filter, thumbnail_url in MediaAssetOut, download proxy endpoint for MinIO/local files
- Admin: "Import Existing Media" button → POST /api/admin/import-media-assets
- Billing: fix invoice create 500 (MissingGreenlet — use selectinload after commit); PDF download uses axios blob instead of bare <a href> (auth header missing); fix storage.upload() accepting str|Path
- SSE task logs: task_logs.py core + router, LiveRenderLog component
- CadPreview: fix infinite loop when no gltf_geometry assets; loading screen before ThreeDViewer render
- render-worker: add trimesh layer to Dockerfile

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/domains/media/service.py

@@ -11,6 +11,7 @@ async def list_media_assets(
     order_line_id: uuid.UUID | None = None,
     cad_file_id: uuid.UUID | None = None,
     asset_type: MediaAssetType | None = None,
+    asset_types: list[MediaAssetType] | None = None,
     is_archived: bool | None = False,
     skip: int = 0,
     limit: int = 50,
@@ -22,7 +23,9 @@ async def list_media_assets(
         q = q.where(MediaAsset.order_line_id == order_line_id)
     if cad_file_id:
         q = q.where(MediaAsset.cad_file_id == cad_file_id)
-    if asset_type:
+    if asset_types:
+        q = q.where(MediaAsset.asset_type.in_(asset_types))
+    elif asset_type is not None:
         q = q.where(MediaAsset.asset_type == asset_type)
     if is_archived is not None:
         q = q.where(MediaAsset.is_archived == is_archived)
@@ -62,10 +65,12 @@ async def delete_media_asset(db: AsyncSession, asset_id: uuid.UUID) -> bool:
 
 
 def get_download_url(asset: MediaAsset) -> str | None:
-    """Get presigned URL from MinIO or local path."""
-    try:
-        from app.core.storage import get_storage
-        storage = get_storage()
-        return storage.get_url(asset.storage_key)
-    except Exception:
-        return f"/uploads/{asset.storage_key}"
+    """Return a backend proxy URL so the browser can always download the file."""
+    return f"/api/media/{asset.id}/download"
+
+
+def get_thumbnail_url(asset: MediaAsset) -> str | None:
+    """Return CAD thumbnail URL if asset has a cad_file_id."""
+    if asset.cad_file_id:
+        return f"/api/cad/{asset.cad_file_id}/thumbnail"
+    return None