feat: extract MediaController, wire into Dispatcher, delete media.php

app/storage/migrations/013_admin_password.sql

@@ -0,0 +1,11 @@
+-- Migration 013: Store admin password hash in site_settings
+--
+-- Previously stored in config/admin_credentials.php as the constant ADMIN_PASSWORD_HASH.
+-- Now stored alongside SMTP credentials in the site_settings key-value table.
+--
+-- After applying this migration, import your existing hash manually:
+--   UPDATE site_settings SET value = '$2y$12$...' WHERE key = 'admin_password_hash';
+-- Or simply set a new one via the admin panel UI.
+
+INSERT OR IGNORE INTO site_settings (key, value) VALUES
+    ('admin_password_hash', '');