feat: media picker and image removal

features/verified_account_required.qa.md

@@ -29,8 +29,7 @@ routers, so the HTTP-level checks live in a new `test/verified_account_required_
    - a nested `r.Group` adding `jwtauth.Authenticator(token)` then
      `middleware.RequireVerifiedUser(getUser)`, containing `r.Get("/{id}", ...)`,
      `r.Post("/", ...)`, `r.Delete("/{id}", ...)`, `r.Patch("/{id}", ...)`,
-     `r.Patch("/{id}/publish", ...)`, `r.Patch("/{id}/unpublish", ...)`,
-     `r.Post("/{id}/image", ...)`
+     `r.Patch("/{id}/publish", ...)`, `r.Patch("/{id}/unpublish", ...)`
    No live server.
 8. Mint jwt cookies with `token.Encode(map[string]any{"user_id": uint32(1)})` for the valid-token
    cases, following the convention in `features/article_publishing.qa.md`.
@@ -45,10 +44,6 @@ routers, so the HTTP-level checks live in a new `test/verified_account_required_
     `PATCH /v1/article/1/unpublish`, each sent with the valid cookie from step 8 → assert status
     `403` and body exactly `apperr.VerificationRequiredErrorMessage`. Assert the article repository
     was not mutated by any of the write calls.
-11. Same seed, `POST /v1/article/1/image` with the valid cookie and a multipart form field `"file"`
-    holding `before.png` / `image/png` → assert status `403`, body
-    `apperr.VerificationRequiredErrorMessage`, and the image repository's `Create` is never called
-    (mirroring the assertion style in `test/upload_article_image_test.go`).
 
 ## HTTP checks: a verified caller is unaffected
 
@@ -127,7 +122,7 @@ routers, so the HTTP-level checks live in a new `test/verified_account_required_
 ## Manual verification (not exercised by the Go test)
 
 - The SPA-visible behaviour of an unverified, logged-in user landing on the back-office article
-  screens (create/edit/publish/image-upload) and seeing a 403 instead of the normal editing UI,
+  screens (create/edit/publish) and seeing a 403 instead of the normal editing UI,
   and the front-office/back-office listing showing only published articles to that same unverified
   session, is out of scope for this slice's automated test and should be checked by hand against a
   running dev build with an unverified test account.