feat: extract MediaController, wire into Dispatcher, delete media.php

app/storage/migrations/009_share_links.sql

@@ -0,0 +1,14 @@
+-- Share links table: enables students to submit TFEs via unique, optional-password-protected URLs
+CREATE TABLE IF NOT EXISTS share_links (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    slug TEXT NOT NULL UNIQUE,               -- Format: YYYYMMDD-<random>, e.g. 20260416-a3f9k2
+    password_hash TEXT,                      -- bcrypt hash; NULL = no password required
+    is_active INTEGER NOT NULL DEFAULT 1,    -- 1 = active, 0 = disabled
+    usage_count INTEGER NOT NULL DEFAULT 0,  -- Number of successful submissions via this link
+    created_by INTEGER NOT NULL,             -- admin user ID (references admin_sessions or admin_users)
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    expires_at DATETIME                      -- NULL = never expires
+);
+
+CREATE INDEX IF NOT EXISTS idx_share_links_slug ON share_links(slug);
+CREATE INDEX IF NOT EXISTS idx_share_links_active ON share_links(is_active);