feat: add Media Studio and shared media generation runtime

[usnavy13]

Summary

Adds Media Studio for creating and iterating on images and videos with persistent history and recoverable generation jobs. With media.enabled configured, users can generate in Studio, reuse results in chat, and open chat media in Studio. Compatible follow-ups reuse the previous result; history cards show the latest available output.

• Shared provider connections, model capabilities, credentials, presets, and parameter validation across Studio and media tools.
• Durable generation, cancellation, retry, provider diagnostics, usage accounting, and administrator recovery for uncertain provider outcomes.
• Native Gemini image output in chat: images become ordinary Files before streaming, while private signed continuation data remains available for later turns.
• Theme-aware controls, bounded dialogs, accessible history actions, preserved generation settings, and automatic plain-text titles.

Depends on LibreChat-AI/agents#553. Related proposal: discussion #16140.

How it works

The API host supplies configuration, persistence, storage, and provider transports. Studio records its intent before a paid request; a worker publishes ordered File outputs and reconciles interrupted work. Native chat uses the SDK port and the existing chat accounting path.

Studio / media tools
  validated request
    durable job and admission
      worker -> provider adapter -> provider
        Files + ordered outputs + usage settlement
          history / activity events / chat handoff

Native Google chat
  SDK NativeMediaPort
    authorize invocation -> persist File -> emit content
      private Message continuation metadata -> authorized replay

Database contracts and queries live in packages/data-schemas, runtime behavior in packages/api/src/media, shared configuration and DTOs in packages/data-provider/src/media, and Studio UI/state in client/src/components/Media. Legacy /api code wires the host into the application. Startup uses canonical user IDs, starts chat history alongside conversation metadata, and loads the Media activity snapshot before opening its event stream.

Type of change

• Feature
• Bug fix
• Refactor
• Performance improvement
• Tests / tooling / CI

Testing

Current head: d7e616f49d8f3a334d47139c2cbda645758dfb56.

• All 40 CI checks passed, including frontend/backend unit tests, typechecks, static checks, production image builds and startup, MongoDB/Redis integration, Lighthouse, and every browser suite.
• Focused local regression suites cover Media persistence and scoped job materialization, SDK contracts, auth response redaction/identity, startup, message-cache races, navigation, active-stream recovery, and restored UI state. The final chat-loading change passed 116 tests in six existing suites; the installed SDK bridge passed 34 contract tests.
• Changed-workspace typechecks, production builds, scoped lint/format checks, and commit hooks passed.
• Focused browser tests passed upload/handoff and configured-footer cases, plus all three affected native quote-selection cases without retries.
• Lighthouse with 250 ms injected per Mongo query passed locally and in Linux CI. CI median LCP is 2.93 s for chat and 3.24 s for restored Studio; CLS and TBT also passed. The 4.5 s LCP, 0.1 CLS, and 500 ms TBT limits are unchanged.
• Chrome smoke testing against the six-service root stack built from this head passed login, history/reload, existing-thread restore, provider/model controls, advanced settings, and deletion-dialog sizing (448 px), cancellation, and focus restoration. No browser errors, Media writes, or paid generations occurred in the smoke test.
• Two independent local reviewers found no remaining material findings at the exact pushed head; there are no inline PR review threads.

Manual browser testing also exercised configured Azure, Gemini, Vertex, and OpenRouter models and follow-up requests. CI browser flows use local fixtures without paid inference.

Risk / compatibility

• Media is opt-in. Provider operations and follow-up semantics vary: supported Vertex Veo continuation extends a clip; OpenRouter video iteration remains limited by provider/reference support.
• The persistence and accounting paths include owner/tenant fencing, retention, and reconciliation. An uncertain paid submission must not be silently submitted again. Native chat stays outside Studio job settlement.
• Native continuation metadata is private; public events, exports, and shares strip it. Legacy stored native records retain a compatibility reader.
• The branch temporarily pins and patches @librechat/agents 4.0.1, the release dev targets; the patch is generated from feat: add native media port for Google image output and host model-invocation tracing agents#553 rebased onto 4.0.1. It must be replaced by published SDK contracts before this PR is ready.

Draft readiness

• Final cleanup reviewed and committed; meaningful regression coverage retained.
• SDK dependency opened and linked.
• SDK PR merged and a containing version published.
• Consume that release and remove the temporary patch, pins, postinstall/build wiring, and patch-specific cache inputs; rerun the installed-package contract and affected checks.
• Add screenshots to this PR and operator-facing documentation in the companion librechat.ai repository as part of final review.
• CI and review pass again after SDK patch removal before marking ready.

[usnavy13]

Security review of 5bcab1f32.

Checked: authorization and owner/tenant scoping on every media route and query, admin routes, SSRF on user-submitted and provider-returned URLs, storage paths and file serving, credential handling, balance holds and settlement, agent tool, chat and share paths, frontend sinks, and the SDK patch, lockfile and CI changes.

Found: nothing high-severity. Two low-severity issues:

1. Public share links returned the media* fields of Studio files to anonymous viewers: rendition storage keys, the owner's thread and conversation ids, and claim and deletion tokens. None of it grants access.
2. Studio asset paths weren't restricted by scheme, so a javascript: path could have reached a download link. The server builds every asset path, so nothing could reach this today.

Fixed in 168c72c:

1. The share sanitizer now drops media* fields.
2. mediaAssetSchema now accepts only same-origin and http(s) paths.

Both fixes have tests that fail on the old code.