Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.

apps/api/internal/support/kb_media_test.go

@@ -0,0 +1,76 @@
+package support
+
+import (
+	"bytes"
+	"image"
+	"image/png"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestSaveAndOpenKBImage(t *testing.T) {
+	dir := t.TempDir()
+	secret := "test-signing-secret-kb"
+
+	var buf bytes.Buffer
+	img := image.NewRGBA(image.Rect(0, 0, 8, 8))
+	if err := png.Encode(&buf, img); err != nil {
+		t.Fatal(err)
+	}
+
+	out, err := SaveKBImage(dir, "http://localhost:28471", secret, "shot.png", "image/png", bytes.NewReader(buf.Bytes()))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if out.ContentType != "image/png" || out.Size <= 0 {
+		t.Fatalf("ct=%s size=%d", out.ContentType, out.Size)
+	}
+	if !strings.HasPrefix(out.AdminURL, KBImageAdminURLPrefix) {
+		t.Fatalf("admin url=%s", out.AdminURL)
+	}
+	if !strings.Contains(out.MarkdownURL, KBImagePublicPathPrefix) || !strings.Contains(out.MarkdownURL, "sig=") {
+		t.Fatalf("markdown url=%s", out.MarkdownURL)
+	}
+	if _, err := os.Stat(filepath.Join(dir, kbMediaSubdir, out.Filename)); err != nil {
+		t.Fatal(err)
+	}
+
+	f, ct, err := OpenKBImage(dir, out.Filename)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	if ct != "image/png" {
+		t.Fatalf("open ct=%s", ct)
+	}
+
+	idx := strings.Index(out.MarkdownURL, "sig=")
+	if idx < 0 {
+		t.Fatal("missing sig")
+	}
+	sig := out.MarkdownURL[idx+4:]
+	if err := VerifyKBImageSig(secret, out.Filename, sig); err != nil {
+		t.Fatalf("verify: %v", err)
+	}
+	if err := VerifyKBImageSig(secret, out.Filename, "deadbeef"); err != ErrKBImageBadSig {
+		t.Fatalf("expected bad sig, got %v", err)
+	}
+}
+
+func TestSaveKBImageRejectsBadType(t *testing.T) {
+	dir := t.TempDir()
+	_, err := SaveKBImage(dir, "http://localhost:28471", "secret", "x.txt", "text/plain", bytes.NewReader([]byte("not-an-image!!!!")))
+	if err != ErrKBImageInvalidType {
+		t.Fatalf("got %v", err)
+	}
+}
+
+func TestResolveKBImagePathRejectsTraversal(t *testing.T) {
+	dir := t.TempDir()
+	_, err := ResolveKBImagePath(dir, "../etc/passwd")
+	if err != ErrKBImageInvalidName {
+		t.Fatalf("got %v", err)
+	}
+}