Site app foundation on the content service

services/site is an Astro app rendered on request by the Node adapter. It
keeps every published note in memory from the content service, refreshes
in the background, and keeps serving the last good copy if the service is
down. SiteIndex answers lookups, addresses, links both ways with roll-ups,
the status log and safe Markdown. Vault images pass through /media.
docs/site.md has the URL map and page rules.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012aSbo2D1qP8cMFQCykf7kx

services/site/src/pages/media/[...file].ts

@@ -0,0 +1,16 @@
+/** Vault images, passed through from the content service with a day's cache. */
+import type { APIRoute } from "astro";
+import { attachment } from "../../lib/content.ts";
+
+export const GET: APIRoute = async ({ params }) => {
+  const file = params.file ?? "";
+  if (!file || file.includes("..")) return new Response("Not found", { status: 404 });
+  const upstream = await attachment(file).catch(() => null);
+  if (!upstream?.ok || !upstream.body) return new Response("Not found", { status: 404 });
+  return new Response(upstream.body, {
+    headers: {
+      "content-type": upstream.headers.get("content-type") ?? "application/octet-stream",
+      "cache-control": "public, max-age=86400",
+    },
+  });
+};