feat: add mod editing, revision merges and secure game storage

Add immutable revisions, PGVN editor, asset replacement, merge and rebase workflows, authenticated media delivery and reachability GC. Harden the script interpreter, pin unrpyc and remove tracked build metadata. Include current compatibility checks, Naninovel import and regression tests.

backend/app/main.py

@@ -1,14 +1,12 @@
 import logging
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI, HTTPException
-from fastapi.responses import FileResponse
+from fastapi import FastAPI
 
-from app.blobs import BLOB_ID_RE, blob_path
 from app.bootstrap import bootstrap
 from app.config import get_settings
 from app.db import SessionLocal
-from app.routers import auth, games, i18n, metadata, roles, users, versions
+from app.routers import auth, games, i18n, media, metadata, mods, roles, users, versions
 
 logging.basicConfig(level=logging.INFO)
 
@@ -24,18 +22,10 @@ async def lifespan(_: FastAPI):
 
 app = FastAPI(title="pgames-manager", lifespan=lifespan, docs_url="/api/docs",
               openapi_url="/api/openapi.json")
-for r in (auth, users, roles, games, versions, i18n, metadata):
+for r in (auth, users, roles, games, versions, i18n, metadata, media, mods):
     app.include_router(r.router)
 
 
 @app.get("/api/health")
 async def health() -> dict[str, str]:
     return {"status": "ok"}
-
-
-@app.get("/blobs/{blob_id}")
-async def blob(blob_id: str) -> FileResponse:
-    """Fallback for running without nginx; in compose nginx serves /blobs itself."""
-    if not BLOB_ID_RE.match(blob_id) or not (path := blob_path(blob_id)).is_file():
-        raise HTTPException(404)
-    return FileResponse(path, headers={"Cache-Control": "public, max-age=31536000, immutable"})