Phase 3: J-IDs, ownership, roles, guest safety, adaptive detail, download

Backend:
- User.role (user/uploader/staff) with can_upload; uploads and downloads
  gated to uploader+; owners and staff can edit their items
- MediaItem.uploaded_by plus J-<id> identity (serializer, admin,
  scan_files --user, first superuser as default owner)
- API resolves J-<id>, bare numeric ids and MD5s; neighbors and lookup
  return j_ids
- Guest safety: mirror e621's anonymous default blacklist into Redis
  (parses comments, negations and wildcards), flag hidden_from_guests
  and filter lists, details and lookups for anonymous users
- POST /api/online/downloads/ writes an e621 file into the watched
  folder and indexes it for the uploader
- MariaDB + Redis via docker compose (host ports 3307/6380), PyMySQL
  driver shim, Redis cache replacing the file cache; SQLite data
  dumped and loaded into MariaDB

Frontend:
- Single /detail/:itemId route with an adaptive shell: J-<id> renders
  the library item, bare numbers render the e621 post
- Legacy /view/<md5> and /online/view/<id> redirect to canonical URLs
- Cards expose J-IDs; library custom-data editor is read-only for
  non-owners
- Role gating: Upload hidden/blocked for regular users, account shows
  the role, guest hint on the library

backend/apps/library/management/commands/scan_files.py

@@ -2,11 +2,14 @@ import os
 from pathlib import Path
 
 from django.conf import settings
+from django.contrib.auth import get_user_model
 from django.core.management.base import BaseCommand
 
 from apps.library.models import MediaLocation
 from apps.library.services import ALLOWED_EXTENSIONS, index_file
 
+User = get_user_model()
+
 
 class Command(BaseCommand):
     help = "Scan the watched folder and index media files into the library."
@@ -17,6 +20,10 @@ class Command(BaseCommand):
             action="store_true",
             help="Remove locations whose files no longer exist on disk.",
         )
+        parser.add_argument(
+            "--user",
+            help="Username that owns newly indexed files (default: first superuser).",
+        )
 
     def handle(self, *args, **options):
         folder = Path(settings.WATCHED_FOLDER)
@@ -26,6 +33,26 @@ class Command(BaseCommand):
             )
             return
 
+        owner = None
+        if options["user"]:
+            owner = User.objects.filter(username=options["user"]).first()
+            if owner is None:
+                self.stderr.write(
+                    self.style.ERROR(f"User not found: {options['user']}")
+                )
+                return
+        else:
+            owner = User.objects.filter(is_superuser=True).order_by("id").first()
+            if owner is None:
+                self.stderr.write(
+                    self.style.WARNING(
+                        "No superuser found; scanned files will have no owner. "
+                        "Use --user <name> to assign one."
+                    )
+                )
+        if owner is not None:
+            self.stdout.write(f"New files will be owned by {owner.username}.")
+
         self.stdout.write(f"Scanning {folder} ...")
         seen = set()
         new_items = 0
@@ -40,11 +67,14 @@ class Command(BaseCommand):
                     continue
                 path = Path(root) / name
                 try:
-                    _, created_item, created_location = index_file(path, folder)
+                    item, created_item, created_location = index_file(path, folder)
                 except OSError as exc:
                     skipped += 1
                     self.stderr.write(f"Skipped {path}: {exc}")
                     continue
+                if owner is not None and item.uploaded_by_id is None:
+                    item.uploaded_by = owner
+                    item.save(update_fields=["uploaded_by", "updated_at"])
                 seen.add(str(path))
                 new_items += int(created_item)
                 if created_location: