feat: phase 4 admin CMS — dashboard, editor, media, CSRF

Head Hen CMS end-to-end: dashboard lists all posts (drafts + published),
Markdown editor with live preview + drag-drop image upload, Pillow media
pipeline re-encoding every upload to JPEG, post CRUD + publish toggle +
hard delete, About page edit, and double-submit CSRF cookie enforced on
every admin mutating endpoint (Phase 3's TODO markers resolved).

Slug auto-generated on create and server-locked once a post has been
published. Unpublish preserves `published_at` so re-publish keeps
original date ordering. Every admin write invalidates the read-side
Post/Page TTL caches and records an `auth_events` audit row.

CSRF middleware is narrow by design — issues/refreshes the `cb_csrf`
cookie only on `GET /admin*`, and mutating endpoints opt in via
`require_csrf_form` or `require_csrf_header` Depends. Public routes,
healthz, and pre-auth login stay untouched.

64 new tests cover slugs, CSRF, media, admin posts/pages services, and
end-to-end CMS routes. Tests never mock the DB — real temp SQLite files
per the CLAUDE.md mandate.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/config.py

@@ -64,6 +64,18 @@ class Settings(BaseSettings):
         description="SQLAlchemy URL for the application database.",
     )
 
+    # --- Media storage -----------------------------------------------------
+    # Filesystem directory holding admin-uploaded images. Mounted
+    # publicly at ``/media`` by the FastAPI factory, so the Markdown
+    # URL inserted after a drag-drop upload matches what the public
+    # site can fetch. Relative paths resolve against the process cwd
+    # (uvicorn runs from the repo root in dev; Docker's WORKDIR in
+    # prod), matching the DATABASE_URL convention.
+    media_root: str = Field(
+        default="data/media",
+        description="Filesystem directory where admin-uploaded media is stored.",
+    )
+
     # --- Email (Resend) ----------------------------------------------------
     # Optional at Phase 0: contact form and magic-link delivery come online
     # in Phases 3 and 5 respectively.