a Media section, browsing the site's originals in place

a new section above Administration. it embeds THE PLATFORM'S OWN file browser rather
than drawing a file list — upload, delete, rename, move, thumbnails, the context
menu and every task hanging off it already exist and are maintained in one place. a
plugin's own would be a second to keep in step, arriving without any of that.

`basePath` IS A JAIL, not a starting folder: `useFileBrowserApp` resets currentPath
whenever it leaves, so pointing it at `<root>/media/originals` means the breadcrumb
stops there and `derived/` is not reachable by navigating. that is what was asked
for — people work in originals, derived is made for them.

IT IS A GUARDRAIL AND NOT A PERMISSION BOUNDARY, and the panel says so in its own
docstring because the difference will matter to whoever reads this next. the
file-browser API is unchanged and still addresses the whole home: anyone with file
access reaches derived/ through the Files screen. this prevents an accident, not a
determined person. confining it properly means scoping that API per user, which is a
platform change and a much larger one.

the panel also says, once, that derived/ exists and is made from these — otherwise
somebody who knows about it would think it had been lost.

`rootRelative` is new on the settings API because only the SERVER knows what home
is. the file browser addresses everything relative to a root, and a browser deriving
that prefix from the absolute path would be guessing. null when the root sits
outside home — a legitimate setting the browser cannot address, which the panel
explains rather than rendering an empty folder.

NOTHING HERE IS FOFOS-SPECIFIC, which matters now that this plugin is the template
for other site admins: the root is a setting, media/originals is the layout this
plugin creates, and both are read from the API. another site's plugin changes the
label.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

web/sections.ts

@@ -1,5 +1,5 @@
 import type { LucideIcon } from 'lucide-react';
-import { Home, Info, Layers, Images, Handshake, Sparkles, Wrench, Settings, Mail, Cog } from 'lucide-react';
+import { Home, Info, Layers, Images, Handshake, Sparkles, Wrench, Settings, Mail, Cog, FolderOpen } from 'lucide-react';
 
 /**
  * The sections of the fofos admin, in nav order.
@@ -29,6 +29,7 @@ import { Home, Info, Layers, Images, Handshake, Sparkles, Wrench, Settings, Mail
 
 export type SectionKey =
   | 'administration'
+  | 'media'
   | 'messages'
   | 'site'
   | 'about'
@@ -132,6 +133,25 @@ export const SECTIONS: Section[] = [
     path: '/fofos-admin/messages',
     built: true,
   },
+  {
+    /*
+      The site's own media, browsed in place.
+
+      Above Administration and below the pages, because it is neither: the pages are the site's CONTENT
+      and Administration is this plugin's machinery, while this is the raw material both draw on. It is
+      also the section somebody uses most often once the site exists, which is the other reason it sits
+      where a hand falls rather than at the bottom.
+
+      `path: null` — it reads no fofos API. It embeds the platform's own file browser, confined to the
+      originals folder under the root location.
+    */
+    key: 'media',
+    label: 'Media',
+    icon: FolderOpen,
+    hint: 'Photos and video the site is built from',
+    path: null,
+    built: true,
+  },
   {
     /*
       Last, and `path: null` — it reads nothing from fofos. Every other section is a window onto the