security: fix all HIGH priority items from TODO.SECURITY.md

Items resolved:
- #3 (HIGH): Move file uploads outside webroot to STORAGE_ROOT (/var/www/posterg/storage).
  Uploads were previously stored in public/admin/actions/data/ which is web-accessible.
- #4 (HIGH): Align file paths and add media.php controller.
  DB paths are now storage-relative (theses/YEAR/ID/file, covers/file).
  New public/media.php serves files with path-traversal jail, MIME allow-list,
  and proper caching headers. memoire.php and search.php updated to use /media.php?path=.
  Also fixed: cover images were never recorded in thesis_files (broken INSERT).
- #5 (HIGH): RateLimit::getClientIdentifier() now uses REMOTE_ADDR only.
  HTTP_X_FORWARDED_FOR and HTTP_CLIENT_IP are attacker-controlled headers that
  allowed unlimited rate-limit bypass by rotating spoofed IPs.
- #6 (HIGH): Port public/admin/.htaccess security rules to nginx/posterg.conf.
  Apache .htaccess directives are silently ignored by nginx; none were active.
  CSP added to /admin/ location block, .log file denial added globally,
  autoindex off made explicit. Documented in nginx/HTACCESS_TO_NGINX.md.

Supporting changes:
- config/bootstrap.php: add STORAGE_ROOT constant
- nginx/SECURITY_HEADERS.md: updated to reflect admin CSP and pending public CSP
- docs/TODO.SECURITY.md: items #3-6 moved to resolved; priority order updated

public/media.php

@@ -0,0 +1,90 @@
+<?php
+/**
+ * Media file serving controller
+ *
+ * Serves uploaded files that are stored outside the webroot (STORAGE_ROOT).
+ * This is the sole access point for thesis files, covers, and annexes — they
+ * are never exposed as direct filesystem paths from the web server.
+ *
+ * Security:
+ *   - Strict character whitelist on the path parameter (no path traversal)
+ *   - realpath() jail: resolved path must stay inside STORAGE_ROOT
+ *   - MIME type verified against an allow-list before serving
+ */
+require_once __DIR__ . '/../config/bootstrap.php';
+
+// --- 1. Extract and validate the requested path -------------------------------
+
+$requestedPath = $_GET['path'] ?? '';
+
+// Only allow safe characters: letters, digits, forward slashes, dots, hyphens, underscores.
+// This explicitly rejects null bytes, backslashes, and sequences like "../".
+if (!preg_match('#^[a-zA-Z0-9/_\-.]+$#', $requestedPath) || $requestedPath === '') {
+    http_response_code(400);
+    exit;
+}
+
+// --- 2. Resolve full filesystem path and enforce storage jail -----------------
+
+$storageRoot = defined('STORAGE_ROOT') ? STORAGE_ROOT : '/var/www/posterg/storage';
+$fullPath    = $storageRoot . '/' . $requestedPath;
+
+$realStorage = realpath($storageRoot);
+$realFull    = realpath($fullPath);
+
+if (
+    $realFull === false
+    || $realStorage === false
+    || strpos($realFull, $realStorage . '/') !== 0
+) {
+    http_response_code(404);
+    exit;
+}
+
+if (!is_file($realFull)) {
+    http_response_code(404);
+    exit;
+}
+
+// --- 3. Verify MIME type from file content (not extension) --------------------
+
+$finfo    = new finfo(FILEINFO_MIME_TYPE);
+$mimeType = $finfo->file($realFull);
+
+$allowedMimes = [
+    'image/jpeg',
+    'image/png',
+    'image/gif',
+    'application/pdf',
+    'video/mp4',
+    'application/zip',
+];
+
+if (!in_array($mimeType, $allowedMimes, true)) {
+    http_response_code(403);
+    exit;
+}
+
+// --- 4. Send response headers -------------------------------------------------
+
+header('Content-Type: ' . $mimeType);
+header('Content-Length: ' . filesize($realFull));
+header('X-Content-Type-Options: nosniff');
+
+$ext = strtolower(pathinfo($realFull, PATHINFO_EXTENSION));
+
+if (in_array($ext, ['jpg', 'jpeg', 'png', 'gif'], true)) {
+    // Images: cache publicly for 7 days
+    header('Cache-Control: public, max-age=604800');
+} elseif ($ext === 'pdf') {
+    // PDFs: cache for 1 day, display inline
+    header('Cache-Control: public, max-age=86400');
+    header('Content-Disposition: inline');
+} else {
+    // Everything else: no public caching
+    header('Cache-Control: private, no-store');
+}
+
+// --- 5. Stream file -----------------------------------------------------------
+
+readfile($realFull);