Admin: write blog posts and manage images

A Posts page lists every post with Write a post: title, topic, kind,
date, summary, a cover picked from the vault or uploaded, the pages it is
about, the Markdown body with a rendered preview, and Save draft or
Publish. An Images page uploads several images into an _attachments
folder, shows which notes use each one, copies its embed line, and
deletes unused ones. The content service gains the attachment list,
upload and delete endpoints behind the editor and admin tokens.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012aSbo2D1qP8cMFQCykf7kx

docs/admin.md

@@ -19,6 +19,8 @@ the vault so Obsidian shows them too. Its changes are recorded with the author
 | Review | Held changes with the rules' reasons and a line diff against the live version. Accept puts it live (and into the vault, for API changes). Reject keeps the live version; for an edit made in Obsidian, "Reject and put the live version back" also rewrites the file. Earlier decisions are listed by status. |
 | Notes, Drafts | Browse and search every note, or only the unpublished ones. |
 | A note | A preview of the body, its fields, what links to it, Publish or Unpublish, and its history. Any earlier version can be compared with the live one and rolled back. |
+| Posts | Every blog post, drafts first, and **Write a post**: title, topic, kind of post, publish date, summary, a cover picked from the vault or uploaded, the pages it is about, Feature it, case study details, and the Markdown body. Preview shows it rendered with its images; Save draft and Publish write the note to `Posts/`. Images added to the post are uploaded to `_attachments/Posts` and appended as `![[file]]` lines. |
+| Images | Everything in `_attachments`, newest first, by folder, with which notes use each one. Upload several at once into a folder, copy an image's `![[file]]` line, and delete images no note uses. |
 | Capture | A status for the Now log, or a Library item with the option to post a status about it in the same step. |
 | Store | Orders open or closed per category, with the reopen date and turnaround, and open slots or stock per product line. |
 | Problems | Whole-folder problems, like links to notes that do not exist. |
@@ -34,8 +36,13 @@ the vault so Obsidian shows them too. Its changes are recorded with the author
   same-origin` (or a matching `Origin`), so a page elsewhere cannot make the
   browser act on the admin page.
 - **Drafts cannot run code.** Previews show raw HTML as text and drop links that
-  are not http, https, mailto or relative. The page sends a content security
-  policy that allows no scripts at all; it works entirely with plain forms.
+  are not http, https, mailto or relative. The content security policy allows
+  only the page's own `/admin.js` (Copy buttons and a confirm before deleting
+  an image), never inline script, and every page still works with plain forms
+  when that script does not run.
+- **Only images go into the vault.** Uploads are checked by extension and by
+  their first bytes, SVG is refused, and an image is deleted only when no note
+  uses it.
 
 ## Running it
 

docs/content-service.md

@@ -96,6 +96,9 @@ roles in `CONTENT_TOKENS`.
 | `POST /api/held/<id>/accept`, `/reject` | editor, admin | Decide a held change. `{ "restore": true }` on reject puts the live version back into the vault. |
 | `POST /api/note/rollback` | admin | `{ path, rev }` |
 | `POST /api/scan` | editor, admin | Compare the whole folder now. |
+| `GET /api/attachments` | editor, admin | Every file in `_attachments`, newest first, with its folder, size and the notes whose text names it (`usedBy`). |
+| `POST /api/attachments?folder=&name=` | editor, admin | The raw bytes of a PNG, JPEG, WebP, GIF or AVIF image (up to 15 MB; SVG is refused because it can carry script). It is saved in `_attachments/<folder>` under a lowercase, hyphenated name, with `-2`, `-3` added when the name is taken anywhere in `_attachments`. Answers `{ name }`. |
+| `POST /api/attachments/delete` | editor, admin | `{ name }`. Refused with 409 while any note still uses the file. |
 | `POST /api/submissions` | intake, admin | File a saved copy of an inquiry or order. Answers `{ id, receipt }`. |
 | `POST /api/submissions/<id>/delivery` | intake (with the receipt, once), admin | `{ receipt, status: sent, failed or skipped, error? }`: how the email went. |
 | `GET /api/submissions?handled=`, `/api/submissions/<id>` | admin | Saved copies, unhandled first, newest first, with counts. |