Fix media picker circle, selector route shadowing, and a media-surface bug sweep

[mdon]

What

Started from an error report — the selected-image checkmark in the media picker modal rendered as an oval, not a circle — and grew into a sweep of the whole media/image surface (pickers, browser, detail page), cross-checked by a multi-reviewer pass over the same files.

The reported bug

The selected-state badge sized itself with padding around an inline-block icon span, so the inherited line-height strut stretched it to 28×36. Both selector surfaces now use the same fixed square + flex centering as their unselected ring (28×28 / 36×36, verified in-browser via getBoundingClientRect), so both states render identical true circles.

Route shadowing (found while verifying)

live "/admin/media/selector" was declared after live "/admin/media/:file_uuid", so the selector page was unreachable — every request bound file_uuid="selector" and crashed with Ecto.Query.CastError. MediaSelectorHelper.build_url/1 exists specifically to hand out URLs to this page, all of which 400'd. Routes reordered.

Sweep fixes

MediaSelector (full-page picker)

• ?page=abc crashed the mount (String.to_integer); zero/negative pages produced negative SQL OFFSETs → safe parse + clamp
• return_to (user-controlled query param) was fed unvalidated to push_navigate → local-path guard
• The listing offered trashed and system-managed files (the modal already excluded both) → same exclusions
• Pagination used navigate (full remount), wiping the in-memory selection and active search on every page change → patch
• Completed uploads never refreshed the grid (the only reload lived in a "save" handler no button triggers), and a failed upload returned {:error, _} from consume_uploaded_entry's callback — which raises — so failures crashed the LiveView → uploads now reload, auto-select the new file, and flash on failure

MediaSelectorModal (the popup)

• Selection was a MapSet, so Confirm returned uuid-sorted order — reopening a gallery picker and confirming silently reordered images and changed the Featured one. Selection is now an ordered list end-to-end
• A :single picker seeded with multiple uuids let Confirm return all of them → clamped to one
• mode passed as a string crashed the upload auto-select case → normalized once in update/2
• change_page crashed on malformed payloads → safe parse

MediaDetail

• Any non-UUID /admin/media/<x> raised Ecto.Query.CastError → renders the existing "File Not Found" state

MediaBrowser

• Trash paging was broken both ways: uncontrolled set_page had no trash arm (page 2 of Trash silently showed active files under the trash header, with permanent-delete actions), and controlled mode round-tripped through the URL contract, which resets trash — exiting the view. Trash/orphaned now page locally through reload_current_page
• Selection carried into the trash view: selections survive the toggle invisibly, and both delete paths key "permanent" off the view, so active files selected before the switch were permanently destroyed. The toggle now clears the selection, and permanent deletion additionally refuses any file whose status isn't "trashed" (also covers a restore racing from another session)
• Sort/type filters were dropped (while their toolbar labels stayed active) by search, clear-search, folder navigation, the orphan toggle, and paging — all loaders now receive list_extra; the dead extra \\ [] defaults are removed so future call sites can't silently regress this
• Leaving trash kept rendering the trashed-folder cards (the assign still held the trash list) → reloads the active folder list
• Folder-delete confirmations said "Files move to parent" — the handler recursively trashes the whole subtree (or permanently deletes it inside Trash, which the bulk confirm didn't mention for folders at all) → all confirm strings now state the actual behavior, per view
• "Select all" and bulk Download missed files in expanded stacks; Download also missed cross-page selections (it only searched the rendered page) → Select all covers stacks, bulk Download resolves the selection from the DB (scope-guarded, like delete); the single-file kebab Download uses locate_file/2
• "Clear" exited selection mode instead of just clearing (there's a separate Cancel)
• Deleting the last item of the last page stranded an empty out-of-range page → reload_current_page clamps
• A non-numeric storage_max_upload_size_mb setting value crashed every media surface at mount → defensive parse

i18n: new/changed strings extracted; et/ru translated (other locales left for the usual catch-up).

Verified

• mix precommit clean; media/storage test files 222/0, test/phoenix_kit_web 363/0
• Browser-verified through phoenix_kit_parent: selector page reachable and rendering; ?page=abc + external return_to handled; /admin/media/<garbage> shows File Not Found; modal open → select (28×28 circle, count badge) → Confirm round-trip works; folder kebab shows the corrected confirm text

Follow-up commit: the four flagged limitations are now fixed too

• MediaGallery.max_count truncation → the modal gained an optional max_select cap: at the cap a :multiple picker rejects further adds and shows a "Maximum N files" badge plus an "N of M selected" counter; seeds clamp the same way; upload auto-select respects the cap (the file still stores and lists). The gallery passes its max_count through, so the Enum.take on confirm is now a belt-and-braces no-op
• Fixed upload accept list → the modal re-allows the upload with the filter's accept whenever the type dropdown changes and nothing is in flight (the server-side type gate still backstops in-flight changes)
• Empty-search empty state → zero-result searches say "No files match your search" instead of claiming the library/folder is empty
• Folder cover/logo rotation → folder header media honors the file's saved rotation. The cover box's aspect is arbitrary, so quarter-turned covers swap their dimensions via container-query units inside an absolutely-positioned [container-type:size] wrapper (which sizes from inset, so the content-driven hero height is unaffected) — covering the box exactly with no hardcoded scale. Logos are square object-contain boxes and ride the plain rotation transform. MediaThumbnail.normalized_rotation/1 is public now for this

Verified: precommit clean, 493 media/storage/web tests green, browser-checked the search empty state and the modal select flow (28×28 circle intact).