fix(admin): serve media from private storage

app/api/media/[filename]/route.ts

@@ -0,0 +1,22 @@
+import { NextResponse } from "next/server";
+import { readMediaFile } from "@/lib/admin/media";
+
+export async function GET(_request: Request, { params }: { params: Promise<{ filename: string }> }) {
+  const { filename } = await params;
+  const media = await readMediaFile(decodeURIComponent(filename));
+
+  if (!media) {
+    return NextResponse.json({ message: "Datei nicht gefunden." }, { status: 404 });
+  }
+
+  return new NextResponse(media.data, {
+    status: 200,
+    headers: {
+      "Content-Type": media.mimeType,
+      "Content-Length": String(media.size),
+      "Content-Disposition": "inline",
+      "Cache-Control": "private, max-age=300",
+      "X-Content-Type-Options": "nosniff",
+    },
+  });
+}