Use firebase storage for EasyEyes Media Library

[Yonathan-Wagaye]

Summary

Makes the Media page actually store files. Uploads previously lived only in the
browser session; they now go to the easyeyes-media Firebase Storage bucket and
are listed back from it.

• New media-library function: GET lists the bucket, POST verifies the
  caller's Pavlovia account against MEDIA_ROLES and returns a short-lived
  resumable upload URL.
• Bytes go from the browser straight to Google. Netlify caps a function request
  body at ~6 MB, which is less than any video.
• The bucket is its own index. Name, size, type, date, and uploader all come
  from object metadata, so there is no second store to keep in step with it.
• Media is served from easyeyes.app/media/* rather than a raw Google URL,
  which is the only way to set the Cross-Origin-Resource-Policy header that
  remote-calibrator and speaker-calibration need under require-corp.
• Existing media is never replaced: an upload whose name is already taken is
  refused, so a link that works today keeps working.

Setup

FIREBASE_MEDIA_SERVICE_ACCOUNT (base64 service account JSON) must be set in
Netlify for all deploy contexts. Run node scripts/setup-media-bucket.mjs once
to apply bucket CORS and public reads; pass a deploy preview URL as an argument
to allow uploads from it.