Add Art section: upload named images, gallery, delete

- Artwork entity (name, stored filename, original name, mime, size, date)
- /art gallery grid; /art/upload (name + image file, PNG/JPEG/GIF/WebP,
  20M cap); /art/{id}/file streams the image behind auth; /art/{id}/delete
  (CSRF) removes row + file
- files stored under var/uploads/art/ (git-ignored, on the php_var volume
  in Docker), served through a controller so they stay login-gated
- "Art" nav item

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

templates/art/index.html.twig

@@ -0,0 +1,45 @@
+{% extends 'base.html.twig' %}
+
+{% block title %}Art · dmtools{% endblock %}
+
+{% block body %}
+    <div class="d-flex justify-content-between align-items-center mb-3">
+        <h1 class="h3 mb-0">Art</h1>
+        <a href="{{ path('app_art_upload') }}" class="btn btn-primary btn-sm">Upload art</a>
+    </div>
+
+    {% if artworks is empty %}
+        <div class="card shadow-sm">
+            <div class="card-body text-center text-body-secondary py-5">
+                Nothing uploaded yet. Use <strong>Upload art</strong> to add maps, handouts or character pieces.
+            </div>
+        </div>
+    {% else %}
+        <div class="row row-cols-1 row-cols-sm-2 row-cols-md-3 row-cols-lg-4 g-3">
+            {% for art in artworks %}
+                <div class="col">
+                    <div class="card shadow-sm h-100">
+                        <a href="{{ path('app_art_file', {id: art.id}) }}" target="_blank" rel="noopener">
+                            <img src="{{ path('app_art_file', {id: art.id}) }}" alt="{{ art.name }}"
+                                 class="card-img-top object-fit-cover" style="height: 180px;"
+                                 loading="lazy">
+                        </a>
+                        <div class="card-body py-2 d-flex justify-content-between align-items-start gap-2">
+                            <div class="min-w-0">
+                                <div class="fw-semibold text-truncate" title="{{ art.name }}">{{ art.name }}</div>
+                                <div class="text-body-secondary small">
+                                    {{ art.uploadedAt|date('Y-m-d') }} · {{ (art.size / 1024)|round }} KB
+                                </div>
+                            </div>
+                            <form method="post" action="{{ path('app_art_delete', {id: art.id}) }}"
+                                  onsubmit="return confirm('Delete “{{ art.name|e('js') }}”?')">
+                                <input type="hidden" name="_token" value="{{ csrf_token('delete-art-' ~ art.id) }}">
+                                <button class="btn btn-sm btn-outline-danger" title="Delete">&times;</button>
+                            </form>
+                        </div>
+                    </div>
+                </div>
+            {% endfor %}
+        </div>
+    {% endif %}
+{% endblock %}

templates/art/upload.html.twig

@@ -0,0 +1,23 @@
+{% extends 'base.html.twig' %}
+
+{% block title %}Upload art · dmtools{% endblock %}
+
+{% block body %}
+    <div class="mb-3">
+        <a href="{{ path('app_art') }}" class="text-decoration-none small">&larr; Art</a>
+        <h1 class="h3 mb-0">Upload art</h1>
+    </div>
+
+    <div class="card shadow-sm" style="max-width: 32rem;">
+        <div class="card-body">
+            {{ form_start(form, {attr: {enctype: 'multipart/form-data'}}) }}
+            {{ form_row(form.name) }}
+            {{ form_row(form.file) }}
+            <div class="mt-3 d-flex gap-2">
+                <button class="btn btn-primary">Upload</button>
+                <a href="{{ path('app_art') }}" class="btn btn-outline-secondary">Cancel</a>
+            </div>
+            {{ form_end(form) }}
+        </div>
+    </div>
+{% endblock %}