feat: media picker and image removal

features/verified_account_required.feature

@@ -12,12 +12,12 @@ Feature: Protected article routes and the offline-inclusive listing require a ve
     Given before this slice, the protected group inside NewArticleRouter (api/router.go) applies
       only jwtauth.Verifier then jwtauth.Authenticator to GET /v1/article/{id}, POST /v1/article/,
       DELETE /v1/article/{id}, PATCH /v1/article/{id}, PATCH /v1/article/{id}/publish,
-      PATCH /v1/article/{id}/unpublish and POST /v1/article/{id}/image, so any caller with a
+      PATCH /v1/article/{id}/unpublish, so any caller with a
       validly signed, unexpired jwt cookie reaches the handler regardless of that account's
       is_verified status
     And this slice adds a third middleware, api/middleware.RequireVerifiedUser(getUser
       *useCases.GetUserUseCase), mounted after jwtauth.Authenticator in that same group, so the
-      order becomes Verifier, Authenticator, RequireVerifiedUser for all seven routes above
+      order becomes Verifier, Authenticator, RequireVerifiedUser for all six routes above
     And RequireVerifiedUser reads user_id from the request's jwt claims using a new exported
       helper, api/pkg/claims.UserId(r *http.Request) (uint32, bool), which replaces the
       identical private userIdFromClaims method api/handlers/auth.Handler.Verify and
@@ -81,16 +81,6 @@ Feature: Protected article routes and the offline-inclusive listing require a ve
       | PATCH  | /v1/article/1/publish       |
       | PATCH  | /v1/article/1/unpublish     |
 
-  Scenario: An unverified user is also refused when attaching an image
-    Given a user repository containing user id 1, is_verified false
-    And a valid jwt cookie for user id 1
-    And the article repository contains an article with id 1 titled "Backyard Renovation Update"
-    When the client sends POST /v1/article/1/image with that cookie and a multipart form field
-      "file" holding a file named "before.png" with content type "image/png"
-    Then the response status is 403
-    And the response body is the apperr.VerificationRequiredErrorMessage text
-    And the image repository's Create is never called
-
   Scenario: A verified user still exercises the protected routes exactly as before
     Given a user repository containing user id 1, is_verified true
     And a valid jwt cookie for user id 1