refactor(handlers): consume port interfaces, wire media+upload assembly (Task 25+26)

- H now holds only small port interfaces (UserStore/LibraryStore/BookStore/
  ProgressStore/BookmarkStore/RateLimiter/Scanner/Media/UploadSessions);
  NewRouter is the composition root distributing *store.Store and *redispkg.R
- ports.Media gains EnsurePage; ChaptersOf returns ports.Chapter (media's
  local duplicate dropped); *media.M now provably satisfies ports.Media;
  ports.UploadSessions gains LibraryID for root validation before Complete
- content.go: duplicated page-index cache + cover self-heal + page extract
  logic removed in favor of media service — same redis keys, same contract;
  path traversal check stays in handler (403 semantics preserved)
- getLibrary/getLibRow merged into getLib(c, id); idParam helper dedupes
  :id parsing; isUnique replaced by ports.IsUniqueViolation (Task 28 partial)
- main.go assembles media + upload and passes upload.U as scanner Sweeper

Full gate green: gofmt, vet, go test -p 1 (real PG+Redis, 0 skip)

backend/cmd/webui/handlers/content.go

@@ -1,15 +1,13 @@
 package handlers
 
 import (
-	"fmt"
-	"log"
+	"errors"
+	"io/fs"
 	"net/http"
 	"os"
-	"path"
 	"path/filepath"
 	"strconv"
 	"strings"
-	"time"
 
 	"github.com/gin-gonic/gin"
 
@@ -20,7 +18,7 @@ import (
 const defaultCover = `<svg xmlns="http://www.w3.org/2000/svg" width="120" height="170"><rect width="120" height="170" rx="6" fill="#2a2a33"/><path d="M30 25h60v120H30z" fill="#3a3a45"/><path d="M30 25h60M60 25v120" stroke="#555" stroke-width="2"/></svg>`
 
 func (h *H) bookRoot(c *gin.Context, b store.Book) (string, bool) {
-	lib, ok := h.getLibRow(c, b.LibraryID)
+	lib, ok := h.getLib(c, b.LibraryID)
 	if !ok {
 		return "", false
 	}
@@ -31,6 +29,26 @@ func (h *H) immutable(c *gin.Context) {
 	c.Header("Cache-Control", "public, max-age=31536000, immutable")
 }
 
+// checkPath 纵深防御:path 越界 → 403,与原契约一致。
+func checkPath(c *gin.Context, root string, b store.Book) (string, bool) {
+	abs, perr := absBookPath(root, b)
+	if perr != nil {
+		err(c, http.StatusForbidden, "forbidden", "unsafe path")
+		return "", false
+	}
+	return abs, true
+}
+
+// mapContentErr 把 media/bookfile 的文件级失败映射回原契约状态码:
+// 文件不在盘上 → 404,其余(坏包等)由调用方决定 422/500。
+func mapContentErr(c *gin.Context, e error) bool {
+	if errors.Is(e, fs.ErrNotExist) {
+		err(c, http.StatusNotFound, "not_found", "file missing on disk")
+		return true
+	}
+	return false
+}
+
 func (h *H) ServeCover(c *gin.Context) {
 	b, ok := h.bookFromParam(c)
 	if !ok {
@@ -48,36 +66,30 @@ func (h *H) ServeCover(c *gin.Context) {
 	}
 	if b.Format == "cbz" || b.Format == "epub" { // 自愈:缓存丢了就地抽封面(重启/卷漂移/扫描器还没跑到)
 		if root, ok := h.bookRoot(c, b); ok {
-			if f, size, ok := h.openBook(c, b, root); ok {
-				defer f.Close()
-				var img []byte
-				var ext string
-				var e error
-				if b.Format == "cbz" {
-					img, ext, e = bookfile.CBZCover(f, size)
-				} else {
-					img, ext, e = bookfile.EPUBCover(f, size)
-				}
-				if e == nil {
-					dst := filepath.Join(dir, "cover"+ext)
-					if e := os.MkdirAll(dir, 0o755); e == nil {
-						tmp := fmt.Sprintf("%s.tmp-%d", dst, time.Now().UnixNano())
-						// B11: check all write errors; clean tmp only on failure.
-						if we := os.WriteFile(tmp, img, 0o644); we != nil {
-							log.Printf("serve: write cover tmp: %v", we)
-							os.Remove(tmp)
-						} else if re := os.Rename(tmp, dst); re != nil {
-							log.Printf("serve: rename cover: %v", re)
-							os.Remove(tmp)
-						} else {
-							http.ServeFile(c.Writer, c.Request, dst)
+			if _, ok := checkPath(c, root, b); ok {
+				e := h.med.EnsureCover(c, b.ID, b.Format, b.FileSize, b.ModTS, root, b.Path)
+				switch {
+				case e == nil:
+					if entries, re := os.ReadDir(dir); re == nil {
+						for _, en := range entries {
+							if !strings.Contains(en.Name(), ".tmp") {
+								http.ServeFile(c.Writer, c.Request, filepath.Join(dir, en.Name()))
+								return
+							}
 						}
 					}
+				case mapContentErr(c, e):
+					return // 404 已回复
 				}
+				// 抽取失败(坏包)→ 落到占位 SVG,与原契约一致
+			} else {
+				return // 403 已回复
 			}
+		} else {
+			return // 404/503 已回复
 		}
 	}
-	if c.Writer.Written() { // openBook/bookRoot 已写 403/404/500,不再叠加占位图
+	if c.Writer.Written() {
 		return
 	}
 	c.Data(http.StatusOK, "image/svg+xml", []byte(defaultCover))
@@ -92,55 +104,32 @@ func (h *H) ServeFile(c *gin.Context) {
 	if !ok {
 		return
 	}
-	abs, perr := absBookPath(root, b)
-	if perr != nil {
-		err(c, http.StatusForbidden, "forbidden", "unsafe path")
+	abs, ok := checkPath(c, root, b)
+	if !ok {
 		return
 	}
-	c.Header("ETag", `"`+bookfile.Hash(b.FileSize, b.ModTS)+`"`)
+	if _, e := os.Stat(abs); e != nil {
+		err(c, http.StatusNotFound, "not_found", "file missing on disk")
+		return
+	}
+	c.Header("ETag", `"`+h.med.CacheBuster(b.FileSize, b.ModTS)+`"`)
 	c.Header("Cache-Control", "private, must-revalidate")
 	http.ServeFile(c.Writer, c.Request, abs)
 }
 
-func (h *H) openBook(c *gin.Context, b store.Book, root string) (*os.File, int64, bool) {
-	abs, perr := absBookPath(root, b)
-	if perr != nil {
-		err(c, http.StatusForbidden, "forbidden", "unsafe path")
-		return nil, 0, false
+// pageIndex 走 media(redis 缓存 + 索引提取);路径校验仍在 handler,保住 403 契约。
+func (h *H) pageIndex(c *gin.Context, b store.Book, root string) ([]string, bool) {
+	if _, ok := checkPath(c, root, b); !ok {
+		return nil, false
 	}
-	f, perr := os.Open(abs)
-	if perr != nil {
-		err(c, http.StatusNotFound, "not_found", "file missing on disk")
-		return nil, 0, false
-	}
-	st, perr := f.Stat()
-	if perr != nil {
-		f.Close()
-		err(c, http.StatusInternalServerError, "internal", "stat")
-		return nil, 0, false
-	}
-	return f, st.Size(), true
-}
-
-func (h *H) pageIndex(c *gin.Context, b store.Book, root string) ([]string, error) {
-	hash := bookfile.Hash(b.FileSize, b.ModTS)
-	key := fmt.Sprintf("pagesidx2:%d:%s", b.ID, hash) // 前缀换代 = 索引逻辑变更时一次性作废旧缓存
-	if v, ok := h.rdb.Get(c, key); ok && v != "" {
-		return strings.Split(v, "\n"), nil
-	}
-	f, size, ok := h.openBook(c, b, root)
-	if !ok {
-		return nil, os.ErrNotExist
-	}
-	defer f.Close()
-	idx, e := bookfile.PageIndex(f, size)
+	idx, e := h.med.PageIndex(c, b.ID, b.FileSize, b.ModTS, root, b.Path)
 	if e != nil {
-		return nil, e
+		if !mapContentErr(c, e) {
+			err(c, http.StatusUnprocessableEntity, "broken", e.Error())
+		}
+		return nil, false
 	}
-	if len(idx) > 0 { // 空索引不缓存,否则 warm 命中 "" 会 Split 出幽灵页
-		h.rdb.Set(c, key, strings.Join(idx, "\n"), 7*24*time.Hour)
-	}
-	return idx, nil
+	return idx, true
 }
 
 func (h *H) PagesCount(c *gin.Context) {
@@ -156,56 +145,11 @@ func (h *H) PagesCount(c *gin.Context) {
 	if !ok {
 		return
 	}
-	idx, e := h.pageIndex(c, b, root)
-	if e != nil {
-		if c.Writer.Written() {
-			return // openBook 已写 403/404,不再叠加 422
-		}
-		err(c, http.StatusUnprocessableEntity, "broken", e.Error())
+	idx, ok := h.pageIndex(c, b, root)
+	if !ok {
 		return
 	}
-	c.JSON(http.StatusOK, gin.H{"count": len(idx), "chapters": chaptersOf(idx)})
-}
-
-type cbzChapter struct {
-	Title string `json:"title"`
-	Start int    `json:"start"`
-}
-
-// chaptersOf 页索引已自然序排列,按父目录分组:每个新目录开一章,标题取目录名;扁平包或只有一组返回 nil
-func chaptersOf(idx []string) []cbzChapter {
-	type grp struct {
-		dir   string
-		start int
-	}
-	var grps []grp
-	last := "\x00"
-	for i, n := range idx {
-		d := path.Dir(n)
-		if d == last {
-			continue
-		}
-		last = d
-		if d == "." { // 根目录散页不开章
-			continue
-		}
-		grps = append(grps, grp{d, i})
-	}
-	if len(grps) < 2 {
-		return nil
-	}
-	titles := make(map[string]int)
-	out := make([]cbzChapter, len(grps))
-	for i, g := range grps {
-		out[i] = cbzChapter{Title: path.Base(g.dir), Start: g.start}
-		titles[out[i].Title]++
-	}
-	for i, g := range grps { // 同名目录(不同父级)撞车 → 用全路径消歧
-		if titles[out[i].Title] > 1 {
-			out[i].Title = g.dir
-		}
-	}
-	return out
+	c.JSON(http.StatusOK, gin.H{"count": len(idx), "chapters": h.med.ChaptersOf(idx)})
 }
 
 func (h *H) Page(c *gin.Context) {
@@ -226,47 +170,22 @@ func (h *H) Page(c *gin.Context) {
 	if !ok {
 		return
 	}
-	idx, e := h.pageIndex(c, b, root)
-	if e != nil {
-		if c.Writer.Written() {
-			return // openBook 已写 403/404,不再叠加 422
-		}
-		err(c, http.StatusUnprocessableEntity, "broken", e.Error())
+	idx, ok := h.pageIndex(c, b, root)
+	if !ok {
 		return
 	}
 	if n >= len(idx) {
 		err(c, http.StatusNotFound, "not_found", "no such page")
 		return
 	}
-	ext := strings.ToLower(filepath.Ext(idx[n]))
-	dir := bookfile.PagesDir(h.cfg.CacheDir, bookfile.DirKey(b.ID, bookfile.Hash(b.FileSize, b.ModTS)))
-	dst := filepath.Join(dir, strconv.Itoa(n)+ext)
-	if _, e := os.Stat(dst); e != nil { // miss → 解压落盘(并发重做同页幂等,唯一 tmp 名 + rename 原子)
-		f, size, ok := h.openBook(c, b, root)
-		if !ok {
-			return
-		}
-		defer f.Close()
-		data, e := bookfile.ReadEntry(f, size, idx[n])
-		if e != nil {
-			err(c, http.StatusInternalServerError, "internal", "extract page")
-			return
-		}
-		if e := os.MkdirAll(dir, 0o755); e != nil {
-			err(c, http.StatusInternalServerError, "internal", "cache dir")
-			return
-		}
-		tmp := fmt.Sprintf("%s.tmp-%d", dst, time.Now().UnixNano())
-		if e := os.WriteFile(tmp, data, 0o644); e != nil {
-			os.Remove(tmp)
-			err(c, http.StatusInternalServerError, "internal", "write cache")
-			return
-		}
-		if e := os.Rename(tmp, dst); e != nil {
-			os.Remove(tmp)
-			err(c, http.StatusInternalServerError, "internal", "rename cache")
+	// miss → 解压落盘(media 内部唯一 tmp 名 + rename 原子,并发重做同页幂等)
+	dst, e := h.med.EnsurePage(c, b.ID, b.FileSize, b.ModTS, root, b.Path, n, idx)
+	if e != nil {
+		if mapContentErr(c, e) {
 			return
 		}
+		err(c, http.StatusInternalServerError, "internal", "extract page")
+		return
 	}
 	h.immutable(c)
 	http.ServeFile(c.Writer, c.Request, dst)