10 — Storage & Media Pipeline

Storage: S3-compatible bucket with server-side encryption; path pattern tenants/{tenant_uuid}/events/{event_uuid}/photos/{photo_uuid}/.
Variants: original + derived sizes in variants/ with content hashing for cache-busting.
Processing: queue jobs for EXIF strip, orientation, resize (multiple sizes), and virus scan; idempotent by UUID.
Delivery: signed URLs for admin; CDN public for guest gallery variants.
Deletion: soft-delete metadata, schedule object purge respecting retention policies.