Document files and the Anki import

AGENTS.md: the file endpoints and the app's files, asset URLs in content,
imported cards, platform plugins behind interfaces, server tests on the sync
engine's database, and GStreamer for Linux builds. ADR 0004: content names
files as asset:<id> URLs, and how stored files are deleted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0004-tree-tags-review-modes-settings-assets.md

@@ -71,7 +71,12 @@ revision's payload, and the per-side merge of ADR 0003 becomes per field.
    otherwise), at a path derived from the space and the hash, and is served only by an
    endpoint that checks the owner. Devices cache files by hash, and the hash checks each
    download. The same file added twice is stored once; two rows for it, from two devices
-   offline, count as one. Content refers to a file by the row's id.
+   offline, count as one. Content refers to a file by the row's id, as the URL
+   `asset:<id>` (amended 2026-10-02): any other URL in content is never fetched, so
+   content from elsewhere can't make devices call a server of its choice. A space's
+   owner and members may download its files; uploads go into the caller's own space,
+   and the server keeps an upload only if its content has the hash it was announced
+   with.
 
 ## Consequences
 
@@ -87,8 +92,12 @@ revision's payload, and the per-side merge of ADR 0003 becomes per field.
   row in each of our synced tables and checks that none is lost, and fails if a synced
   table has no row there.
 - Stored files outlive their rows unless deleted with them: deleting a person, or a
-  file nobody refers to anymore, has to delete the stored file too. That comes with the
-  file endpoints.
+  file nobody refers to anymore, has to delete the stored file too. Built with the file
+  endpoints (2026-10-02): `deletePerson` deletes the person's files in its transaction,
+  and a daily job deletes files no live row refers to, and uploads never finished, 7
+  days after they were last claimed (an upload may reach the server before its row;
+  asking for a file again claims it anew). Rows of files no content refers to any more
+  aren't deleted yet, so their files stay until the person goes.
 - Media makes the database, and so its backups, grow. The storage can move to S3 or
   similar later without changing the rows, since the path is derived from the hash.