Add secure media access control with authenticated proxy endpoints

- Add MediaHandler with token-based proxy endpoints for serving media:
  - GET /api/media/document/:id
  - GET /api/media/document-image/:id
  - GET /api/media/completion-image/:id
- Add MediaURL fields to response DTOs for documents and task completions
- Add FindImageByID and FindCompletionImageByID repository methods
- Preload Completions.Images in all task queries for proper media URLs
- Remove public /uploads static file serving for security
- Verify residence access before serving any media files

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

internal/repositories/residence_repo.go

@@ -317,6 +317,8 @@ func (r *ResidenceRepository) GetTasksForReport(residenceID uint) ([]models.Task
 		Preload("Priority").
 		Preload("Status").
 		Preload("Completions").
+		Preload("Completions.Images").
+		Preload("Completions.CompletedBy").
 		Where("residence_id = ?", residenceID).
 		Order("due_date ASC NULLS LAST, created_at DESC").
 		Find(&tasks).Error