fix: let a media file belong to more than one entry

media.entry_id modelled ownership as one entry per file, but link_to_entry
reassigns it on every save. Embedding the same image in a second entry
therefore moved the claim, and deleting that second entry deleted the file
out from under the first — a broken image in the entry and a 404 on its
share link.

A join table replaces the column. Deleting an entry now removes only the
files no other entry embeds, and link_to_entry runs in a transaction so an
entry is never briefly attached to nothing while its share link is being
read.

migrations/0002_entry_media.sql

@@ -0,0 +1,18 @@
+-- `media.entry_id` claimed a file for exactly one entry. Embedding the same
+-- file in a second entry silently moved the claim, and deleting that second
+-- entry then deleted a file the first one still displayed. A join table lets a
+-- file belong to as many entries as embed it.
+
+CREATE TABLE entry_media (
+    entry_id INTEGER NOT NULL REFERENCES entries (id) ON DELETE CASCADE,
+    media_id TEXT    NOT NULL REFERENCES media (id)   ON DELETE CASCADE,
+    PRIMARY KEY (entry_id, media_id)
+) WITHOUT ROWID;
+
+CREATE INDEX idx_entry_media_media_id ON entry_media (media_id);
+
+INSERT INTO entry_media (entry_id, media_id)
+    SELECT entry_id, id FROM media WHERE entry_id IS NOT NULL;
+
+DROP INDEX idx_media_entry_id;
+ALTER TABLE media DROP COLUMN entry_id;