feat: harden media upload validation

server/migrations/014_bunny_video_ownership.sql

@@ -0,0 +1,16 @@
+create table if not exists bunny_video_uploads (
+  video_id text primary key,
+  owner_id uuid not null references users(id) on delete cascade,
+  created_at timestamptz not null default now()
+);
+
+create index if not exists bunny_video_uploads_owner_index on bunny_video_uploads (owner_id);
+
+-- Preserve access to Bunny videos created before ownership was tracked.
+insert into bunny_video_uploads (video_id, owner_id)
+select distinct on (lm.external_id) lm.external_id, c.instructor_id
+from lesson_media lm
+join lessons l on l.id = lm.lesson_id
+join courses c on c.id = l.course_id
+where lm.provider = 'bunny'
+on conflict (video_id) do nothing;