Add consent-gated media exchange library

docs/frontend.md

@@ -16,6 +16,7 @@ Shared HTTP/SSE schemas live in `packages/api-contracts`. The server and client
 | `/conversations` | Searchable account-aware conversation inbox. |
 | `/conversations/:conversationId` | Conversation history, context, suggestions, and guarded sending. |
 | `/media` | Authenticated, privacy-conscious media gallery and sync controls. |
+| `/media-library` | Upload, classify, correct, enable, preview, and delete shared exchange images. |
 | `/performance` | Mature outcome trends, strategy/subreddit results, and model usage. |
 | `/operations` | Background jobs, sync state, events, rate limits, and technical logs. |
 | `/settings` | Validated runtime configuration and account/session management. |
@@ -58,6 +59,8 @@ The login form exchanges the administrator token for an HttpOnly, SameSite=Stric
 
 Media may be private conversation content. Preserve authenticated URLs, blur/privacy defaults, explicit reveal behavior, safe new-tab links, and no token leakage into query strings or local storage.
 
+Exchange-library uploads require an explicit consent checkbox before the raw image request is enabled. Previews remain blurred by default. The management card exposes AI tags, safety level, confidence/review state, enablement, and a two-step delete action. Its progression rail mirrors the actual nonspecific-request selection tiers rather than implying that explicit anatomy requests follow the same sequence.
+
 ## Feature structure
 
 Each route is a slice under `features/<name>/` with page/route components, local styles, and feature-specific helpers. Cross-feature visual/domain components live under `components/`; application lifecycle belongs under `app/`; transport belongs under `api/`.