feat(uploads): restrict to webp/avif with conversion hint

test/admin_test.rb

@@ -134,7 +134,7 @@ class AdminTest < Minitest::Test
          "_csrf" => token,
          "file" => Rack::Test::UploadedFile.new(txt_path, "text/plain")
     assert_equal 415, last_response.status
-    assert_equal "unsupported_media_type", JSON.parse(last_response.body)["error"]
+    assert_equal "unsupported_format", JSON.parse(last_response.body)["error"]
   end
 
   def test_upload_rejects_file_too_large
@@ -154,18 +154,18 @@ class AdminTest < Minitest::Test
     login
     get "/admin/posts/new"
     token = csrf(last_response.body)
-    image_path = File.join(@dir, "pic.png")
-    File.binwrite(image_path, "PNGDATA")
+    image_path = File.join(@dir, "pic.webp")
+    File.binwrite(image_path, "WEBDATA")
     post "/admin/uploads",
          "_csrf" => token,
-         "file" => Rack::Test::UploadedFile.new(image_path, "image/png")
+         "file" => Rack::Test::UploadedFile.new(image_path, "image/webp")
     assert_predicate last_response, :ok?
     url = JSON.parse(last_response.body)["url"]
     assert_match(%r{\A/media/}, url)
 
     get url
     assert_predicate last_response, :ok?
-    assert_equal "PNGDATA", last_response.body
+    assert_equal "WEBDATA", last_response.body
   end
 
   def test_settings_requires_login