Fix staged upload previews and allow WebP

- Staged files are now served through a signed URL (Django signing, 24h)
  so <img>/<video> tags can load previews without an Authorization
  header; the file endpoint accepts header auth or a valid signature,
  rejects tampered signatures, and still scopes access to the owner
- Serializer responses now carry the request context so URLs are signed
  per user
- Add .webp to the allowed extensions (backend + upload hint)

backend/apps/library/services.py

@@ -13,8 +13,18 @@ from django.utils.text import get_valid_filename
 
 from .models import MediaItem, MediaLocation
 
-ALLOWED_EXTENSIONS = {".jpg", ".jpeg", ".png", ".gif", ".apng", ".mp4", ".webm"}
+ALLOWED_EXTENSIONS = {
+    ".jpg",
+    ".jpeg",
+    ".png",
+    ".gif",
+    ".apng",
+    ".webp",
+    ".mp4",
+    ".webm",
+}
 VIDEO_EXTENSIONS = {".mp4", ".webm"}
+UPLOAD_FILE_SALT = "j621.upload-file"
 CHUNK_SIZE = 1024 * 1024
 RANGE_RE = re.compile(r"bytes=(\d*)-(\d*)$")