Fix staged upload previews and allow WebP

- Staged files are now served through a signed URL (Django signing, 24h)
  so <img>/<video> tags can load previews without an Authorization
  header; the file endpoint accepts header auth or a valid signature,
  rejects tampered signatures, and still scopes access to the owner
- Serializer responses now carry the request context so URLs are signed
  per user
- Add .webp to the allowed extensions (backend + upload hint)

frontend/src/features/upload/UploadPage.tsx

@@ -724,7 +724,7 @@ export default function UploadPage() {
           Drag & drop files here
         </p>
         <p className="text-xs text-ctp-overlay0">
-          or click to select — PNG, JPG, GIF, APNG, MP4, WEBM
+          or click to select — PNG, JPG, GIF, APNG, WEBP, MP4, WEBM
         </p>
         <input
           ref={inputRef}