Upload images through the API, and from the MCP server

POST /api/v1/media stores an image where the panel keeps a page's and
answers with the path to send as `featured_image`. Without it the MCP
server could create a page but never give it a picture. The file goes
through Media::for(), so it is processed, served and pruned like one
uploaded in the panel.

Two ways in, one per request: a multipart `file`, or JSON with a `url`
the API downloads itself. JPEG, PNG, WebP, GIF or AVIF only, decided
from the bytes; no SVG, which is a document that can carry script.

The URL is fetched from inside the stack's network, so RemoteImage
guards it: HTTPS only, every resolved address must be public, the
connection is pinned to the checked address with CURLOPT_RESOLVE so a
changing DNS answer cannot swap in a private one, redirects are not
followed, and the body is read to a ceiling whatever its headers say.

Uploading needs permission to write pages. MediaPolicy::create stays
false, so the panel gains no free-standing "new file" button.

In the MCP server a multipart binary field becomes `<field>_path` over
stdio: the server reads the file from the caller's disk and sends it
as multipart, instead of the model pushing base64 through its context.
Over HTTP the server's disk is not the caller's, so only `body.url` is
offered.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lang/ca/rules.php

@@ -28,4 +28,17 @@ return [
     'pages' => [
         'cannot_publish' => 'No tens permís per publicar pàgines.',
     ],
+
+    'media' => [
+        'not_an_image' => 'El fitxer no és una imatge JPEG, PNG, WebP, GIF o AVIF.',
+        'remote' => [
+            'https_only' => 'La URL de la imatge ha de començar per https://.',
+            'unresolvable' => 'No s\'ha pogut resoldre el domini de la URL.',
+            'private' => 'La URL apunta a una adreça privada o reservada: només es descarreguen imatges d\'adreces públiques.',
+            'unreachable' => 'No s\'ha pogut connectar amb la URL.',
+            'redirect' => 'La URL redirigeix a una altra adreça. Fes servir l\'adreça final de la imatge.',
+            'status' => 'La URL ha respost :status en lloc de la imatge.',
+            'too_large' => 'La imatge supera el màxim de :max KB.',
+        ],
+    ],
 ];

lang/en/rules.php

@@ -28,4 +28,17 @@ return [
     'pages' => [
         'cannot_publish' => 'You do not have permission to publish pages.',
     ],
+
+    'media' => [
+        'not_an_image' => 'The file is not a JPEG, PNG, WebP, GIF or AVIF image.',
+        'remote' => [
+            'https_only' => 'The image URL must start with https://.',
+            'unresolvable' => 'The URL\'s domain could not be resolved.',
+            'private' => 'The URL points at a private or reserved address: images are only downloaded from public ones.',
+            'unreachable' => 'Could not connect to the URL.',
+            'redirect' => 'The URL redirects elsewhere. Use the image\'s final address.',
+            'status' => 'The URL answered :status instead of the image.',
+            'too_large' => 'The image is larger than the :max KB limit.',
+        ],
+    ],
 ];

lang/es/rules.php

@@ -28,4 +28,17 @@ return [
     'pages' => [
         'cannot_publish' => 'No tienes permiso para publicar páginas.',
     ],
+
+    'media' => [
+        'not_an_image' => 'El fichero no es una imagen JPEG, PNG, WebP, GIF o AVIF.',
+        'remote' => [
+            'https_only' => 'La URL de la imagen tiene que empezar por https://.',
+            'unresolvable' => 'No se ha podido resolver el dominio de la URL.',
+            'private' => 'La URL apunta a una dirección privada o reservada: solo se descargan imágenes de direcciones públicas.',
+            'unreachable' => 'No se ha podido conectar con la URL.',
+            'redirect' => 'La URL redirige a otra dirección. Usa la dirección final de la imagen.',
+            'status' => 'La URL ha respondido :status en lugar de la imagen.',
+            'too_large' => 'La imagen supera el máximo de :max KB.',
+        ],
+    ],
 ];