[SiteRelEnby]

Fixes #21.

Two bugs in the markdown bio/description editor's image handling.

1. Uploading an image silently failed

• The upload posted with the endpoint's default purpose (avatar) instead of bio, so bio images were tagged wrong and bypassed the bio-images gate. Now uploads pass purpose=bio, matching web (uploadFile(file, "bio")).
• The delegate set an error in its state on failure, but nothing in the UI ever read it - so a rejected upload just disappeared with no feedback. The editor now surfaces the failure reason under the field.

Between these, a failed upload is now visible and diagnosable instead of silent, and successful uploads are tagged correctly.

2. Hosted images were labelled "external"

Two causes:

• Uploaded images embedded the absolute response URL instead of the canonical /v1/files/<key> path. Web (and the app's own "Existing image" picker) embed the path form; the backend rewrites it to the real signed/CDN URL on read.
• isHostedImageUrl only matched /v1/files/. On the hosted instance, files resolve to a CDN (s3_public_url) whose URLs contain no /v1/files/, so every hosted image was classified external.

Now uploads embed /v1/files/<key>, and isHostedImageUrl also matches the instance's file CDN base - mirroring web's isHostedImage(src, cdnBase). The CDN base (file_cdn_base from the auth config, already persisted in prefs) is provided app-wide via a LocalFileCdnBase composition local, so both the bio editor and the journals image panel classify correctly without threading it through every caller.

Tests

• New ImageSourceClassificationTest: /v1/files/ (relative, signed, absolute-through-API), CDN-base matching, trailing-slash handling, and host-boundary safety (a cdn.example.com.evil.net lookalike stays external).
• :app:testPlayReleaseUnitTest and :app:assemblePlayRelease green.

Notes

• The exact server-side rejection that caused the original silent failure wasn't reproducible from here, but it's now surfaced to the user, so whatever the instance returns (uploads disabled, too large, bad format) is visible.
• Not device-tested here; worth a manual pass: upload an image in a bio, confirm it embeds and shows "hosted", and confirm a rejected upload shows an error.