Internal Store Media

Workers call this over the Railway private mesh to upload bytes into Bunny without holding Bunny credentials themselves. Returns the same shape store_generated_content_bytes returns (file_id, url, path, expires_at, content_type) so worker code can drop in directly.

Body is raw bytes. Headers carry the metadata: X-Internal-Secret shared secret (same as worker auth) Content-Type media content type (image/png, video/mp4, ...) X-Worker-Name origin worker for log attribution (optional) X-Storage-Folder worker-outputs (default) or user-uploads

Consolidating uploads here means BUNNY_STORAGE_ACCESS_KEY + BUNNY_TOKEN_SECURITY_KEY only need to live on the gateway, not on every media worker — single rotation surface, single audit trail, single TTL clamp pulled from system_config.