feat: Openinary medya galerisi — görsel yükleme/seçme (mucomutfak klasörü)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/index.mjs

@@ -14,6 +14,8 @@ const { pool, ensureSchema, seedFromFiles, exportToFiles, isValidSlug } =
 const { startPublish, getPublishState, DIST_DIR } = await import(
   "./publish.mjs"
 );
+const { listMedia, proxyUpload, deleteMedia, mediaEnabled, MEDIA_ROOT } =
+  await import("./media.mjs");
 
 const PORT = Number(process.env.ADMIN_PORT || 3001);
 const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD;
@@ -133,6 +135,41 @@ app.post("/api/admin/import", requireAuth, async (_req, res) => {
   res.json(result);
 });
 
+// ---- Medya (Openinary proxy, mucomutfak klasörü) ----
+
+app.get("/api/admin/media", requireAuth, async (req, res) => {
+  if (!mediaEnabled())
+    return res.status(503).json({ error: "Medya servisi yapılandırılmamış" });
+  try {
+    res.json(await listMedia(String(req.query.path || MEDIA_ROOT)));
+  } catch (e) {
+    res.status(e.status || 500).json({ error: e.message });
+  }
+});
+
+// Multipart body Openinary'ye stream edilir; express.json bu content-type'a dokunmaz
+app.post("/api/admin/media/upload", requireAuth, async (req, res) => {
+  if (!mediaEnabled())
+    return res.status(503).json({ error: "Medya servisi yapılandırılmamış" });
+  try {
+    const { status, body } = await proxyUpload(req);
+    res.status(status).json(body);
+  } catch (e) {
+    res.status(502).json({ error: e.message });
+  }
+});
+
+app.delete("/api/admin/media", requireAuth, async (req, res) => {
+  if (!mediaEnabled())
+    return res.status(503).json({ error: "Medya servisi yapılandırılmamış" });
+  try {
+    await deleteMedia(String(req.query.path || ""));
+    res.json({ ok: true });
+  } catch (e) {
+    res.status(e.status || 500).json({ error: e.message });
+  }
+});
+
 // Publish: DB -> JSON -> vite-ssg build -> dist swap (runs in background)
 app.post("/api/admin/publish", requireAuth, (_req, res) => {
   const started = startPublish();