fix: let a media file belong to more than one entry

media.entry_id modelled ownership as one entry per file, but link_to_entry
reassigns it on every save. Embedding the same image in a second entry
therefore moved the claim, and deleting that second entry deleted the file
out from under the first — a broken image in the entry and a 404 on its
share link.

A join table replaces the column. Deleting an entry now removes only the
files no other entry embeds, and link_to_entry runs in a transaction so an
entry is never briefly attached to nothing while its share link is being
read.

web/src/lib/api.ts

@@ -33,7 +33,8 @@ export interface MediaFile {
   size: number
   created_at: number
   url: string
-  entry_id: number | null
+  /** Every entry that embeds this file — a file may be used by several. */
+  entry_ids: number[]
 }
 
 export class ApiError extends Error {