feat(web): multi-file batch upload endpoint (POST /shrink-batch)

[seonghobae]

Summary

The web app's /shrink accepts exactly one file, so users who batch-shrink folders with the CLI had no web equivalent. This PR adds POST /shrink-batch: upload multiple media files, get back a single zip with every shrunk output plus a results.json manifest.

What's included

• POST /shrink-batch — accepts list[UploadFile] (up to MAX_BATCH_FILES = 20) and target_bytes, converts each file with the existing media_shrinker.convert_file engine, and returns one ZIP_STORED archive.
• results.json manifest inside the zip — per-file index, filename, status (ok/error), output_name, output_bytes, and error message.
• Per-file failure isolation — a failing conversion is recorded in the manifest; the rest of the batch continues.
• Web UI — additive "Shrink Multiple Files" form (multiple file input) posting to the new endpoint; existing single-file form untouched.
• /shrink is untouched — handler code and all its existing tests are unmodified and passing.

Validation & security

• 400 for zero files, more than 20 files, or target_bytes <= 0.
• Per-file audio/* / video/* content-type allowlist (rejected files recorded in the manifest, not converted).
• Per-file MAX_UPLOAD_BYTES cap using the same 1 MB chunked save pattern as /shrink; whole request still bounded by the existing request-size middleware.
• Outputs are only added to the zip if they resolve inside the request's temp workspace (path-escape guard).
• Isolated input_N/ / output_N/ dirs per upload — duplicate filenames cannot collide; zip entries are index-prefixed.
• Temp workspace cleaned up after the response via BackgroundTasks.

Tests (13 new, FastAPI TestClient with mocked convert_file)

• Two files → zip contains both outputs + manifest with statuses/sizes
• One file fails → other still in zip, manifest records the failure, no internal paths leaked
• Zero files / 21 files / target_bytes=0 → 400
• Disallowed content type → per-file manifest error, batch continues
• No-output result, oversized upload, workspace-creation failure, zip-write failure, outside-workspace output guard, unsafe-filename fallback, UI form presence

Gates

• coverage report --include=saas_web.py → 100% (182 stmts, 0 miss)
• interrogate -c pyproject.toml saas_web.py → 100%
• unittest discover -s tests → 126 tests, no new failures (baseline exactly 5 macOS os.listxattr errors)

🤖 Generated with Claude Code