Phase 3: J-IDs, ownership, roles, guest safety, adaptive detail, download

Backend:
- User.role (user/uploader/staff) with can_upload; uploads and downloads
  gated to uploader+; owners and staff can edit their items
- MediaItem.uploaded_by plus J-<id> identity (serializer, admin,
  scan_files --user, first superuser as default owner)
- API resolves J-<id>, bare numeric ids and MD5s; neighbors and lookup
  return j_ids
- Guest safety: mirror e621's anonymous default blacklist into Redis
  (parses comments, negations and wildcards), flag hidden_from_guests
  and filter lists, details and lookups for anonymous users
- POST /api/online/downloads/ writes an e621 file into the watched
  folder and indexes it for the uploader
- MariaDB + Redis via docker compose (host ports 3307/6380), PyMySQL
  driver shim, Redis cache replacing the file cache; SQLite data
  dumped and loaded into MariaDB

Frontend:
- Single /detail/:itemId route with an adaptive shell: J-<id> renders
  the library item, bare numbers render the e621 post
- Legacy /view/<md5> and /online/view/<id> redirect to canonical URLs
- Cards expose J-IDs; library custom-data editor is read-only for
  non-owners
- Role gating: Upload hidden/blocked for regular users, account shows
  the role, guest hint on the library

backend/apps/accounts/admin.py

@@ -6,4 +6,18 @@ from .models import User
 
 @admin.register(User)
 class CustomUserAdmin(UserAdmin):
-    pass
+    list_display = ("username", "email", "role", "is_staff", "is_superuser")
+    list_filter = UserAdmin.list_filter + ("role",)
+    fieldsets = UserAdmin.fieldsets + (
+        (
+            "J621",
+            {
+                "fields": (
+                    "role",
+                    "e621_username",
+                    "e621_api_key",
+                    "e621_base_url",
+                )
+            },
+        ),
+    )

backend/apps/accounts/migrations/0003_user_role.py

@@ -0,0 +1,18 @@
+# Generated by Django 6.1.1 on 2026-09-17 15:01
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0002_user_e621_api_key_user_e621_base_url_and_more'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='user',
+            name='role',
+            field=models.CharField(choices=[('user', 'User'), ('uploader', 'Uploader'), ('staff', 'Staff')], default='user', max_length=20),
+        ),
+    ]

backend/apps/accounts/models.py

@@ -3,8 +3,18 @@ from django.db import models
 
 
 class User(AbstractUser):
-    """Project user with optional e621 API credentials."""
+    """Project user with optional e621 API credentials and an app role."""
 
+    ROLE_USER = "user"
+    ROLE_UPLOADER = "uploader"
+    ROLE_STAFF = "staff"
+    ROLE_CHOICES = [
+        (ROLE_USER, "User"),
+        (ROLE_UPLOADER, "Uploader"),
+        (ROLE_STAFF, "Staff"),
+    ]
+
+    role = models.CharField(max_length=20, choices=ROLE_CHOICES, default=ROLE_USER)
     e621_username = models.CharField(max_length=100, blank=True, default="")
     e621_api_key = models.CharField(max_length=100, blank=True, default="")
     e621_base_url = models.CharField(max_length=200, default="https://e621.net")
@@ -12,3 +22,7 @@ class User(AbstractUser):
     @property
     def e621_configured(self):
         return bool(self.e621_username and self.e621_api_key)
+
+    @property
+    def can_upload(self):
+        return self.is_superuser or self.role in {self.ROLE_UPLOADER, self.ROLE_STAFF}

backend/apps/accounts/serializers.py

@@ -6,6 +6,7 @@ from .models import User
 
 class UserSerializer(serializers.ModelSerializer):
     e621_configured = serializers.BooleanField(read_only=True)
+    can_upload = serializers.BooleanField(read_only=True)
 
     class Meta:
         model = User
@@ -15,6 +16,8 @@ class UserSerializer(serializers.ModelSerializer):
             "email",
             "is_staff",
             "date_joined",
+            "role",
+            "can_upload",
             "e621_username",
             "e621_configured",
         ]